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Abstract. We show strongly secret achievable rate regions for two dif- 
ferent wiretap multiple-access channel coding problems. In the first prob- 
lem, each encoder has a private message and both together have a com- 
mon message to transmit. The encoders have entropy-limited access to 
common randomness. If no common randomness is available, then the 
achievable region derived here does not allow for the secret transmis- 
sion of a common message. The second coding problem assumes that 
the encoders do not have a common message nor access to common ran- 
domness. However, they may have a conferencing link over which they 
may iteratively exchange rate-limited information. This can be used to 
form a common message and common randomness to reduce the sec- 
ond coding problem to the first one. We give the example of a channel 
where the achievable region equals zero without conferencing or common 
randomness and where conferencing establishes the possibility of secret 
message transmission. Both coding problems describe practically rele- 
vant networks which need to be secured against eavesdropping attacks. 
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1 Introduction 

The wiretap Multiple- Access Cli;uiii(;l (MAC) combines two areas where Rndolf 
Ahlswede has made major contributions. In the area of multi-user information 
theory, he [9] and Liao [25] independently gave one of the first complete charac- 
terizations of the capacity region of a multi-iiser channel the MAC with one 
message per sender. Later, Dueck [18] proved the strong converse for the MAC 
and Ahlswede [10] gave an elementary proof immediately afterwards. Slepian 
and Wolf generalized the results from [9] and [25] to the case where the senders 
additionally have a common message [32]. Willems used Slepian and Wolf's re- 
sult to derive the capacity region of the MAC with conferencing encoders. This 
is a MAC withoiit common message, hut the encoders can exchange rate- limited 
information about their messages in an interactive conferencing protocol [38, 39]. 
The results of Slepian and Wolf as well as Willems' result were only recently gen- 
eralized to general compound MACs with partial channel state information in 
[37] , arbitrarily varying MACs with conferencing encoders were treated in [36] . 
The latter paper made substantial use of techniques developed by Ahlswede 
for single-sender arbitrarily varying channels in [1-3] and also of his and Cai's 
contribution to arbitrarily varying MACs [5] . 

The other area of Ahlswede's interest which plays a role in this paper is 
secrecy and common randomness. Among other problems, he considered together 
with Csiszar in [6, 7] how a secret key can be shared at distant terminals in 
the presence of an eavesdropper. Work on secret key sharing aided by public 
communication goes back to Maurer [28]. The first paper which exploits the 
statistics of a discrete memoryless channel to establish secret communication is 
due to Wyner [40]. He considers the wiretap channel, the simplest model of a 
communication scenario where secrecy is relevant: a sender would like to transmit 
a message to a receiver over a discrete memoryless channel and transmission is 
overheard by a second receiver who should be kept ignorant of the message. It 
was noted by Wyncr that a secret key shared at both legitimate terminals is not 
necessary to establish secret transmission - if the channel statistics are taken 
into consideration, it is sufficient that the sender randomizes his inputs in order 
to secure transmission. 

Since Wyner discovered this fact, information-theoretic secrecy for message 
transmission without a key shared between sender and legitimate receiver has 
been generalized in various directions. The first paper on multi-user information- 
theoretic security is due to Csiszar and Korner [15]. Here, the second receiver 
only is a partial eavesdropper: there is a common message intended for both 



receivers, but as in the original wiretap channel, an additional private message 
intended for the first receiver must be kept secret from the second. Wc come to 
multiple-access models below. An overview over the area is given in [24]. 

The original secrecy criterion used in [40] and [15] and in most of the sub- 
sequent work until today has become known as the "weak secrecy criterion". 
Given a code, it measures the mutual information normalized by the code block- 
length between the randomly chosen message and the eavesdropper's output 
corresponding to the application of the code and transmission over the chan- 
nel. Maurer introduced the "strong secrecy criterion" in [29] by omitting the 
normalization. The advantage of this criterion was revealed in [11]: it can be 
given an operational meaning, i.e. one can specify the attacks it withstands. It 
is possible to show that if transmission obeys the strong secrecy criterion, then 
the eavesdropper's average error tends to one for any decoder it might apply. 
Translated into practical secrecy schemes, this means that no matter how large 
the computing power of a possible eavesdropper might be, it will not succeed in 
breaking the security of this scheme. For the weak criterion, there are still only 
heuristic argumentations as to why it should be secret. Further secrecy metrics 
are presented in [12], but without giving them an operational meaning, strong 
secrecy remains the strongest of these metrics. To our knowledge, there are three 
different approaches to establishing strong secrecy in a wiretap channel so far 
[28, 14, 17]. In fact, the last of these approaches also applies to classical-quantum 
wiretap channels [17] and also was used to give an achievable rate for the classical 
compound wiretap channel [11]. 

There exist many MAC models where secrecy is an issue. This may even 
be the case when there is no eavesdropper, as each encoder might have access 
to noisy observations of the other sender's codeword but wants to protect its 
own message from decoding at the other sender [27,23, 19]. The case where the 
encoders have access to generalized feedback but only keep their messages se- 
cret from an external eavesdropper is considered in [33]. In the cognitive MAC, 
only one encoder has a private message, and together, the encoders have a com- 
mon message. There are again two cases: In the case without an eavesdropper, 
the encoder without a private message has access to the codeword sent by the 
other encoder through a noisy channel and must be kept ignorant of the other 
encoder's private message [26]. In [31], the cognitive MAC without feedback 
was investigated where the messages must be kept secret from an eavesdropper 
and the encoders have unrestricted access to common randomness. All of these 
papers use the weak secrecy criterion. 

The first part of this article generalizes and strengthens the achievability 
result from [20] where multi-letter characterizations of an achievable region and 
of an outer bound on the capacity region of a MAC without common message 
and with an external eavesdropper under the weak secrecy criterion are given. 
The channel needs to satisfy certain relatively strong conditions for the bounds 
to work. Extensions to the Gaussian case can be found in [20,34,21]. 

We consider two senders Alice i and Alice2. Each has a private message and 
together they have a common message. This message triple must be transmitted 



to Bob over a discrete memoryless MAC in such a way that Eve who obtains a 
version of the sent codewords through another discrete memoryless MAC cannot 
decode the messages. We apply the strong secrecy criterion. In order to find a 
code which satisfies this criterion, we use Devetak's approach [17], which in the 
quantum case builds on the Ahlswede- Winter lemma [8] and classically on a 
ChernofI bound. It is similar to the approach taken in [13]. As the senders have 
a common message and as the second part of the paper deals with the wiretap 
MAC with conferencing encoders, we assume that the encoders have access to 
a restricted amount of common randomness. Common randomness for encoding 
has so far only been used in [31], but without setting any limitations on its 
amount. Note that this use of common randomness in order to establish secrecy 
differs from the use made in [6, 7]. We only obtain an achievable region. In this 
achievable region it is not possible to transmit a common message if no common 
randomness is available. Further it is notable that we use random coding and 
have to apply time-sharing before derandomizing. 

The wiretap MAC with common message and common randomness is also 
needed in the second part of this paper about the wiretap MAC with confer- 
encing encoders. Conferencing was introduced by Willems in [38, 39] and is an 
iterative protocol for the senders of a MAC to exchange information about their 
messages. One assumes that the amount of information that is exchanged is 
rate-limited because otherwise one would obtain a single-encoder wiretap MAC. 
Willems already used the coding theorem for the MAC with common message to 
deduce an achievable region for the conferencing MAC. The same can be done 
for the wiretap MAC with conferencing encoders. More precisely, aside from the 
senders' private messages, there are no further messages to be transmitted, and 
no common randomness is available. However, conferencing is used to produce 
both a common message and common randomness, which allows the reduction. 
A consequence of the fact that no common message can be transmitted by the 
wiretap MAC with common message if there is no common randomness is that 
one has to use conferencing to establish some common randomness if this is 
supposed to enlarge the achievable region compared to what would be achiev- 
able without conferencing. Again, this consequence presumes that the achievable 
region equals the capacity region even though we cannot prove this. 

Information-theoretic security has far-reaching practical consequences. As 
digital communication replaces more and more of the classical paper-based ways 
of communication even for the transmission of sensible data, the problem of se- 
curing these data becomes increasingly important. Information-theoretic secrecy 
provides an alternative to the traditional cryptographic approach which bases on 
the assumption of limited computing power. However, as information-theoretic 
security uses the imperfections of the channels to secure data, its models must be 
sufficiently complex to describe realistic scenarios. Our article shows how encoder 
cooperation can be utilized to secure data. The cooperation of base stations in 
mobile networks is included in future wireless network standards, and our work 
can be seen as a contribution to the theoretical analysis of how it fares when 
it comes to security. But already Csiszar and Korner's paper on the broadcast 



channel with confidential messages shows how messages with different secrecy 
requirements can be combined in one transmission. A more recent example which 
also applies the strong secrecy criterion is given in [41]. 

Organization of the paper: The next section introduces the general model 
of a wiretap MAC and also presents the Willems conferencing protocol. Section 

3 contains the two achicvability theorems for the wiretap MAC with common 
message and the wiretap MAC with conferencing encoders. 

The common message theorem is treated in the rather long Section 4. First, 
the regions we claim to be achievable are decomposed into regions whose achicv- 
ability can be shown more easily. Following Devetak, it is shown that it is suffi- 
cient to make Eve's output probability given a message triple almost independent 
of this triple in terms of variation distance. Then, in the mathematical core of 
the paper, we derive lower bounds on the randomness necessary to achieve strong 
secrecy using probabilistic concentration results. Here we also follow Devetak. 
Having derived these bounds, we finally find a realization of the random codes 
which defines a good wiretap code. 

Section 5 gives the proof of the achicvability theorem for the wiretap MAC 
with conferencing encoders. We again have to decompose the claimed regions 
into regions whose achievability can be shown more easily. Then we can reduce 
the problem of achieving a certain rate pair with conferencing to the problem 
of achieving a certain rate triple by the wiretap MAC with common message 
more or less in the same way as done by Willems in the non-wiretap situation. 
Finally, Section 6 shows that conferencing may help in situations where no secret 
transmission is possible without and that for our approach it is necessary to do 
the time-sharing within the random coding. 

Notation: For sets {!,..., M}, where M is a positive integer, we use the com- 
binatorial shorthand [M]. For a real number x we define [x]+ :— max{x, 0}. 

For any set JT and subset A C we write A" := \ A. We let 1.4:.^ ^ 
{0, 1} be the indicator function of A which takes on the value 1 at a; G if and 
only ifx G A. Given a probability space (I?, .c/. P) we write E for the expectation 
corresponding to P and for A G ^ and a real- valued random variable X we write 
E[X;A] :=E[X1a]. 

The space of probability distributions on the finite set ^ is denoted by 
^{,3^). In particular, it contains for every 2: €E ^ the probability measure 
defined by 6x{x) — 1. The product of two probability distributions P and Q 
is denoted by P (8 Q- A stochastic matrix with input alphabet ^ and output 
alphabet iF is written as a mapping : — > The n-fold memoryless 

extension of a channel : — > ^(^) is denoted by W^®", so that for x = 
{xi,...,Xn) G and z = {zi,...,Zn) G 

n 

W®''{z\x)=l[W{zi\xi). 



We also define for P G ^( JT ) and W : =^ -> ^{T)the probability distribution 
P (g W e X ^) by (P iy)(a;, 0) = P{x)W{z\x). 

Every measure fj. on tlie finite set ^ can be identified with a unique function 
: ^ — >■ [0, 00]. Then for any subset A C we have = J2xeAl^{^)- 

the set of measures on JT, we define the total variation distance by 

IImi - M2II X! I^i(^) ~ M2(a;)|. 

Given a random variable X living on ^ and a P S ^{3^), we mean hy X ^ 
P that P is the distribution of X. Given a pair of random variables {X, Y) taking 
values in the finite set <^ x we write Px S ^(<^) for the distribution of X 
and Px\Y for the conditional distribution of X given Y. We also write g C <!?^" 
for the subset of 5-typical sequences with respect to X and T^^ysiv) ^ 
for the subset of conditionally (5-typical sequences with respect to Px\y given 
y G Given a sequence x G and an a; G we let A''(a;|x) be the number 
of coordinates of x equal to x. 

For random variables X, Y, Z we write H{X) for the entropy of X, H{X\Y) 
for the conditional entropy of X given Y , I{X A Y) for the mutual information 
of X and Y and I{X AY\Z) for the conditional mutual information of X and 
Y given Z. 

Acknowledgment: Wc would like to thank A. J. Pierrot for bringing the 
papers [30] and [42] to our attention. They consider strong secrecy problems in 
multi-user settings with the help of resolvability theory. In particular, in [42], an 
achievable region for the wiretap MAC without common message or conferencing 
is derived. 

2 The Wiretap Multiple- Access Channel 

The wiretap Multiple- Access Channel (MAC) is described by a stochastic matrix 

W : ^ ^ ^ X 2f, 

where !X , 5' , 2!: are finite sets. We write Wi, and We for the marginal channels 
to ^ and 2^ , so e.g. 

W^(t\x,y) := W{t,z\x,y). 

and 'W are the finite alphabets of Alicei and Alice2, respectively. 3' is the 
finite alphabet of the receiver called Bob and the outputs received by the eaves- 
dropper Eve are elements of the finite alphabet ^ . 

2.1 With Common Message 

Let He be a nonnegative real number. A wiretap MAC code with common mes- 
sage and blocklength n satisfying the common randomness bound He consists 



of a stochastic matrix 

G : [Kq] X [K^] x [K^] .^(.T" x 



and a decoding function 

: ^" ^ [Ko] X [Xi] X [i^2]. 
G is required to have the form 

G(x,y|fco,A;i,A;2) = ^ Go(i|fco)Gi(x|fco, A;i,i)G2(y|fco, fc2,i), 

where ^ is some finite set and 

G2 : [i^o] X [K2\ X ^ ^ ^(^). 

Further, Go has to satisiy that H{J\Mq) < nHc for Mq uniformly distributed 
on [Kq] and Pj\Mo = ^o- [-f^o] is called the set of common messages, [i^i] is the 
set of Alicci's private messages and [K2] the set of Alice2's private messages. 

Let Mq, Ml, M2 be independent random variables uniformly distributed on 
[Ko], [Ki] and [K2], respectively. Further, let X",y",r",Z" be random vari- 
ables such that for (x,y,t,z) e x ^" x ^" x 

Px"y"|MoMiAf2(x,y|fco,fcl,fc2) = G(x,y|fco,fci,fc2), 

Pt"Z^\x^Y"MoMiM2 (t) zlx, y, ko,ki,k2) = W^'^t, z|x, y). 
Then the average error of the code defined above equals 

P[(p(T")^(Mo,Mi,M2)]. 

Definition 2.1. A rate pair {Ro,Ri,R2) £ R>o achievable by the wiretap 

MAC with common message under the common randomness hound He > 
if for every r] > and every e G (0, 1) and n large there exists a wiretap MAC 
code with common message and blocklength n satisfying the common randomness 
bound He and 

-logK„> R,^7j (i. = 0,l,2), 

n 

P[^(T") ^ (Mo,Mi,M2)] <e, 
7(Z" A M0M1M2) < e. 

Remark 2.2. It was shown in [11] that no matter how Eve tries to decode the 
messages from the Alices, the average error must tend to one. More precisely, 



assume that a wiretap code with common message and blocklength n is given, 
and assume that Eve has a decoding function 



X : ^" ^ [Ko] X [i^i] X [K2]. 



Then 



P[x(^")7^(Mo,Mi,M2)] >!-£' 



for some e' which tends to zero as s tends to zero. If e tends to zero exponentially 
fast and Kq,Ki,K2 grow exponentially, then s' tends to zero at exponential 
speed. 

More generally assume that / : [Kq] x [Ki] x [K2] — > [K'] is a function 
satisfying P[/(Mo, Mi, M2) = k'] = 1/K' for all k' G [K']. Then with the same 
argument as in [11] one can show that for every function g : iF" — t- [K'], one 
has P[/(M) ^ giZ")] >l-l/K'-e' for the same e' as above. That is, even for 
K' = 2, blind guessing is the best way for Eve to estimate f{M). In particular, 
no subset of the message random variables, like Mq or (Mi, M2), can be reliably 
decoded by Eve. 

2.2 With Conferencing Encoders 

In the wiretap MAC with conferencing encoders, Alicei and Alice2 do not have a 
common message nor common randomness. However before forming their code- 
words, they may exchange some information about their private messages accord- 
ing to an iterative and randomized "conferencing" protocol whose deterministic 
form was introduced by Willems [38, 39]. If the respective message sets are [Ki] 
and [i^2], such a stochastic Willems conference can be described as follows. Let 
finite sets and ^2 be given which can be written as products 



for some positive integer / which does not depend on v. A Willems conferenc- 
ing stochastic matrix c completely describing such a conference is determined 
in an iterative manner via sequences of stochastic matrices ci^i, . . . ,cij and 
C2,i, • • • J C2J. ci^i describes the probability distribution of what Alicei tells Alice2 
in the i-th conferencing iteration given the knowledge accumulated so far at 
Alicei. Thus in general, using the notation 



— X . . . X ^v^I 



(I. = 1,2) 



V := 



1 iiv = 2, 

2 if !/ = 1, 



these stochastic matrices satisfy for v = 1,2 and i = 2 



,1, 



c^,i : [K^] X ^i5,i X ... X Jfp,i-i ^( 



The stochastic matrix c : [Ki] x [K2\ — > ■'^{^\ x ^2) is obtained by setting 

c(ji,i' ■ • • Jl,lj2,l,- ■ ■,j2,l\kl,k2) 
■= Cl,lOl,l|fcl) C2,i02,l|fc2) • ■ • 

■ • ■ Cl,/(jl,j|A;i, j2,l, . . . , j2,/-l) C2,j(i2,/|fc2,il,l, • • . , 

We denote the ^i- and ^2-niarginals of this stochastic matrix by ci and C2, 
so Ci(ji,i, . . . , A:2) is obtained by summing over 32,1, ■■■ ,32,1 and C2 is 

obtained analogously. 

Now wc define a wiretap MAC code with conferencing encoders. It consists 
of a Willcms conferencing stochastic matrix c : [Ki] x [^^2] ^(^1 X ^2) as 
above together with encoding stochastic matrices 

Gi : [ifi] X ^2 ^ 
G2 : [K2] X ^1 ^ ^" 

and a decoding function 

^: ^"^ [i^i] X [i^2]. 

[ifi] is the set of Alicci's messages and [K2] is the set of Ahce2's messages. A 
pair {ki,k2) £ [Ki] x [if 2] is encoded into the codeword pair (x, y) e x 
with probability 

5^ c(ii,j2|fcl,fc2)Gi(x|fci,j2)G2(y|fc2,il). (1) 

In particular, conferencing generates common randomness. As both Ci and C2 
may depend on both encoders' messages, the codewords may as well depend on 
both messages. Thus if conferencing were unrestricted, this would transform the 
MAC into a single- user wiretap channel with input alphabet ^ ^'W . However, 
Willems introduces a restriction in terms of the blocklength of the code which is 
used for transmission. For conferencing under conferencing capacities Ci, C2 > 0, 
he requires that for a blocklength-n code, \^\ \ and \^2\ satisfy 

^log|AI<C'- (i^=l,2). (2) 

We also impose this constraint and define a wiretap MAC code with conferencing 
capacities Ci,C2 > to be a wiretap MAC code with conferencing encoders 
satisfying (2). 

Let a wiretap MAC code with conferencing encoders be given and let Mi, M2 

be independent random variables uniformly distributed on \K]\ and XK-^^ re- 
spectively. Let Ar",y",T",.Z" be random variables such that conditional on 
(Mi,M2), the distribution of (X",y") is given by (1) and such that 

Then the average error of the code defined above equals 



P[^(T")^(Mi,M2)]. 



Definition 2.3. A rate pair {Ri,R2) G M>q is achievable by the wiretap MAC 
with conferencing encoders at conferencing capacities C1.C2 > if for every 
ri > and every e € (0, 1) and for n large there exists a wiretap MAC code with 
conferencing capacities C\ , C2 and blocklength n satisfying 

-logK^>R,-r] {v = l,2), 
n 

P[<^(T")^(Mi,M2)] <£, 
J(Z" A M1M2) < e. 

Remark 2.4- Here again, as in Remark 2.2, the average decoding error for any 
decoder Eve might apply tends to 1 if the security criterion is satisfied. 



3 Coding Theorems 

3.1 For tiie Wiretap MAC with Common Message 

Let He > be the common randomness bound. The rate region whose achiev- 
ability we are about to claim in Theorem 3.1 can be written as the closure of 
the convex hull of the union of certain rate sets which are parametrized by the 
elements of a subset of the set 11 which is defined as follows. 11 contains 

all probability distributions p of random vectors {U, Vi,V2,X,Y, T, Z) living on 
sets '^xrixr2X^x^x^x^, where ^,^1,^2 are finite subsets of the 
integers and where p has the form 

P = Pu® Pv^\U «) PV2\U ® Px\Vr ® Py\V2 » W. 

Next we define Uhc ■ There arc four cases altogether, numbered Case to 
Case 3. Case corresponds to He = and if He > 0, then Hhc has the form 
= ^ffc ^ ^ ' ^^'^ ea-ch of these subsets corresponds to one of 
these cases. The one condition all cases have in common is that I{Z A Vil^) < 
I{T A V1V2). 

Case 0: If He = define the set JTq as the set of those p £ H where Vi 
and V2 arc independent of U (so wc can omit U in this case and Vi and V2 are 
independent) and where p satisfies the inequalities 

I{Z A Vi)< I {T A Vi\V2), (3) 
I{Z AV2) < I{T AV2\Vi). (4) 

For p & Ho define the set {p) to be the set of nonnegative triples {Rq, Ri,R2) 
satisfying 

i?o =0, 

Ri < I{T AVi\V2) - liZ AVi) - [I{Z AV2\Vi) - I{T AV2\Vi)]+, 
R2 < I{T A V2\Vi) - I{Z A V2) - [I{Z A Vi\V2) - I{T A Vi\V2)]+, 
Ri+R2< I{T A V1V2) - I{Z A V1V2). 



Case 1: -ffj^^ is the set of those p € II which satisfy I{Z AU) < He and 

I{Z AVi\U) < I{T AVi\V2U), (5) 
I{Z AV2\U) <I{T AV2\ViU), (6) 
I{Z AViV2\U) < I(T AVi\V2U) + I(T AV2\ViU). (7) 

Then we denote by ^^^\p) the set of nonnegative real triples {Ro,Ri,R2) sat- 
isfying 

i?i < I{T AVi\V2U) - I{Z AVi\U) 

- [I{Z A V2\ViU) - I{T A V2\ViU)] + , 
Ri < I{T A V2\ViU) - I{Z A V2\U) 

- [I{Z A Vi\V2U) - I{T A Vi\V2U)U, 
Ri + R2 < I{T AViV2\U) - I{Z AViV2\U), 

Ro + Ri+R2< I{T A V1V2) - I{Z A V1V2). 

Case 2: The conditions for p to be contained in H^^ cannot be phrased as 
simply as for Hj^^ . Generally, if p e then 

mm{I{Z AViU),I{Z AV2U)} < He < I{Z AV1V2). 

This is sufficient if I{Z AVi\V2U) = I{Z AV2\ViU). If I{Z AVi\V2U) > I{Z A 
V2\ViU) then we additionally require that 

(2) ^ / I{ZAV,U)-He _ IiTAV2\ViU) 

• "^^""yil^z AVi\V2U)-I{Z AV2\ViU)' I{ZAV2\ViU)' 
(2) ^ . ( IiTAVi\V2U) IjT AViV2\U) - IjZ AV2\ViU) 
_«! : '^''^yj(^ZAVi\V2U)' I{ZAVi\V2U)-I{ZAV2\ViU)' 

whereas if I{Z A Vi\V2U) < I{Z A VzlViU) then we need 

(2) ^ / I{TAV2\ViU) IjT A ViV2\U) - IjZ A V2\ViU) 
"° ■ "^^""V I{Z AV2\ViU)' I{Z AVi\V2U)-I{Z AV2\ViU)' 
(2) ^ . / He^IjZAViU) I{TAV,\V2U) 

_«! . "^'"^yj^z AV2\ViU)-IiZ AVi\V2U)' I{Z AVi\V2U)' 

In the case of equality, i.e. if I{Z A Vi\V2U) = I{Z A V2\ViU), we define ^^^^{p) 
as 

Ri < I{TAVi\V2U), 
R2<I{TAV2\ViU), 
Ri+R2<I{TAViV2\U)-I{Z AVi\V2U), 
Ro + Ri+R2< I{T A V1V2) - I{Z A V1V2). 



If I{Z A Vi\V2U) > I{Z A V2\ViU), we define ^^^\p) by 

Ri < I{T AVi\V2U) - a^Q^h{Z AVi\V2U), 

R2 < I{T A V2\ViU) - (1 - a^^^)I{Z A Fal^iC/), 

i?i + i?2 </(TAyiy2|c/)-ao'^-r(^Ayi|y2C/) (8) 

-(l-af )/(ZAy2|V^iC/), 
/(T A Flit/) 

Ro + Ri+R2< I{T A ^1^2) - I{Z A ^11^2). 
The bound (8) on Rx + _R2 can be reformulated as 
Ri+R2< I{T AViV2\U) - I{Z AViV2\U) 

+ mm\ He - I{Z A U), I{Z AVi\U), 



1] I{Z AV2\ViU), 



and if I{Z A V2IV1C/) > 0, we can give the weighted sum bound (9) the almost 
symmetric form 

Ri ^ R2 ^ I{TAVx\U) ^ I{TAV2\ViU) _ ^ 



I{ZAVi\V2U) I{Z AV2\ViU) - I{Z AVi\V2U) I{Z AV2\ViU) 

For the case that I(ZAVi\V2U) < I{ZAV2\ViU), we define ^(^^ (p) by exchanging 
the roles of Vi and V2. 

Case 3: We define H^^l to be the set of those p G H with I{Z AV1V2) < He 
and for such a p let ^^^^ (p) equal 

Ri <I{TAVi\V2U), 

i?2 < I(TAV2\ViU), 
Ri+R2< I{TAViV2\U), 
Rn + Ri+R2< I{T A V1V2) - I{Z A V1V2). 

Theorem 3.1. For the common randomness bound He = 0, the wiretap MAC 
W with common message achieves the set 

closure ^onv ^ |J ^'"^ (p) j j . (10) 
// He > 0, then the closure of the convex hull of the set 

y u u ^^^^{p) u u ^'^'^\p) 

pen^^^^ pen^Z pen^^ 



is achievable. 



Rem,ark 3.2. Using the standard Caratheodory-Fenchel technique, one can show 
that one may without loss of generaUty assume \'^\ < |.^||^|+5. However, l^i] 
and 1 cannot be bounded in this way, as the apphcation of the Caratheodory- 
Fenchel theorem does not preserve the conditional independence of Vi and V2. 
Thus a characterization of the above achievable region involving sets with upper- 
bounded cardinality is currently not available. As it would be important for an 
efficient calculation of the achievable region, it still requires further consideration. 

Remark 3.3. If no common randomness is available, then no common message 
can be transmitted. 

Remark 3.4. We have ^^'^\p) C C ^'^^\p). This can be seen directly 

at the beginning of the proof in Subsection 4.1 where we decompose the regions 
^^'^\p) for v = 1,2 into a union of simpler regions. 

In particular, if He is larger than the capacity of the single-sender discrete 
memoryless channel We with input alphabet Y. W and output alphabet 

(3) 

then = n and the achievable set equals 



This equals the secrecy capacity of the single-sender wiretap channel when Alicei 
and Alice2 together are considered as one single sender. In order to see this, we 
have to show that for any pair {VI, V2) of random variables on any Cartesian 
product "^1 X of finite sets one can find random variables (Vi ,V2,U) satisfying 
PuViV.2 = Pu®{Pvi\u®Pv2\u) and Pvi^s = Pv(vi- Given such arbitrary {¥(,¥2) 
as above, just define U = V{ and Pvi\u = the identity on Yi and Pv2\u = Pv,^\v(- 
Then a simple calculation shows that the above conditions are satisfied. Thus 
(11) equals the secrecy capacity of the single-sender wiretap channel with Alicei 
and Alice2 combined into a single sender. The remaining conditions on Ri and 
i?2 formulated in the definition of ^^^\p) are not concerned with We, they are 
required by the non- wiretap MAC coding theorem applied to W^. 

3.2 For the Wiretap MAC with Conferencing Encoders 




In this case the maximal sum rate equals 



:= max(7(T A V1V2) - I{Z A V1V2)). 



(11) 



For conferencing capacities Ci, C2 > 0, the achievable rate region is parametrized 
by the members of Uc^+Ci- We have Cases 1-3 from the common message part. 



Case 1: For p e ^^cV+Cs '^^^'^^ £^'-^Kp, (^i, C'2) by 

Ri < I{T AVi\V2U) ~ I{Z AVi\U) 

-[I{Z AV2\ViU) - I{T AV2\ViU)]+ + Ci - [I{Z A U) - C2U, 
R2 < I{T A V2\ViU) - I{Z A V2\U) 

-[I{Z A Vi\V2U) - I{T A Vi\V2U)]+ +C2- [I{Z AC/) - Ci]+, 
Ri+R2< min{7(T A ViV2\U) + Ci + C2,/(T A V1V2))} - I{Z A V1V2)). 

Case 2: For p e ^^Ci+Cs' set := aI{Z A V2U) + (1 - a)I{Z A ViU). 
For a e [q{,^\ af ^] define the set Ci, C2) by 

i?i < I{T A Vi\V2U) - aI{Z A Vi\V2U) + Ci - [J^"^ - C2] + , 

i?2 < I{T AV2\ViU)~{l- a)I{Z AV2\VxU)+C2- [4"^ -Ci] + , 
i?i + i?2 < min{/(r A ViV2\U) + Ci + C2, 1{T A V1V2)} - I{Z A V1V2). 

Then we set 

^(2) (p, c, , C2) := U .^i') (p, Ci , C2). 

(2)^ ^ (2) 

Case 3: For p e i^Ci+Cs '^'^ define Ci, C2) by 

i?i < /(T A Vx\V2U) + Ci- [I{Z A V1V2) -C2] + , 
R2 < I{T A V2\ViU) + C2- [I{Z A V1V2) - Ci] + , 
Ri+R2< min{7(T A ViV2\U) + Ci + C2, 1{T A V1V2)] - I{Z A V1V2). 

Theorem 3.5. For the conferencing capacities Ci,C2 > 0, the wiretap MAC 
W with conferencing encoders achieves the closure of the convex hull of the set 

\j ^«(p,ci,c2) u y ^(2)(p,ci,c2) u y ,#3)(p,ci,c2). 

p^n^nl p^n^Z P^<1; 

Remark 3.6. Remark 3.2 applies here, too. 

Remark 3. 7. The stochastic conferencing protocols employed to achieve the sets 
in Theorem 3.5 are non-iterative. That means that the c we use in the proof 
have the form 

c{Vi,V2\ki,k2) = Ci{vi\ki)C2{V2\k2). 

Remark 3.8. If Ci = C2 = 0, then the maximal rate set whose achievability 
we can show is (10). Conferencing only enlarges this set in the presence of a 
wiretapper if it is used to establish common randomness between the encoders. 
At least this is true for the achievable region we can show, it cannot be verified 
in general as long as one does not have a converse. The reason is that confer- 
encing generates a common message shared by Alicei and Alice2. As noted in 



Remark 3.3, a common message can only be kept secret if common randomness 
is available. As the Alices do not have common randomness a priori, this also 
has to be generated by conferencing, so the Willems conferencing protocol has 
to be stochastic. 

Remark 3. 9. With the coding method we apply, conferencing may enable secure 
transmission if this is not possible without. That means that there are wiretap 
MACs where the achievable region without conferencing as derived in Theorem 
3.1 only contains the rate pair (0,0) whereas it contains non-trivial rate pairs 
with Ci, 6*2 > 0. See Section 6 for an example. 

Remark 3.10. If Ci, C2 arc sufficiently large, then the maximal achievable sum 
rate equals the secrecy capacity of the single-sender wiretap channel with 
input alphabet X and channel matrix W , see (11). In fact, this happens if 

1) Ci + C2 is strictly larger than the capacity of the single-sender discrete mem- 
oryless channel We with input alphabet 3^ x W and output alphabet 2f, 

2) Ci + C2 > miupgn* liT A U), where U* contains those p € 11 which achieve 

Condition 1) is sufficient to guarantee that ^ is achievable by an (^kuxicnt of 
^C\+Ci which then equals 17, see Remark 3.4. In particular 7J* is nonempty, and 
2) ensures that the maximum over il of the sum rate bounds from .^^^^ (p, Ci , C2 ) 
equals ^. 



4 Proof of Theorem 3.1 
4.1 Elementary Rate Regions 

For Cases 0, 1 and 2 we first show the achievability of certain rate regions whose 
union or convex combination then yields the achievable regions claimed in the 
theorem. 



For Case and 1: We only consider Case 1, Case is analogous. The consider- 
ations hold for I{ZKVx\V) < I{ZaVi\V2U) which is equivalent to I{ZaV2\U) < 
I(Z A V2IV1/7). In the case of equality we can prove the achievability of <^(p) 
directly. Define 



lij AV2\ViU) - I{Z AV2\ViU) 



I{Z AV2\U) - I{Z AV2\ViU) 



(1) 

a\ := mm 



I{T AVi\V2U) - I{Z AVi\U) 
I{Z AVi\V2U)- I{Z AVi\U)' 



Note that conditions (5)-(7) are equivalent to Qq^'' < a[^\ For a £ [ag^^a^^^] 
we define a rate region (p) by the bounds 

Ri < I{T AVi\V2U)- aI{Z AVi\V2U)-{l- a)I{Z AVi\U), 
R2 < I{T AV2\ViU) - aI{Z AV2\U) - {1 - a)I{Z AV2\ViU), 
Ri + R2< HT A ViV2\U) - I{Z A ViV2\U), 
Ro + Ri + R2< HT A V1V2) - I{Z A V1V2). 
Lemma 4.1. We have 

(1)^ ^ (1) 

Thus if ^i^\p) is an achievable rate region for every a G [ag^"*, a^^"*], then 
^''^\p) is achievable. 

For the proof we use the following lemma which is proved in the appendix. 

Lemma 4.2. Assume that ai, a2, 61, 62, c, d, ri,r2, ^12,^012 are nonnegative reals 
satisfying 

ai>bi, 02 < 62, oi + a2 = &i + ^2 = c, ri+r2>ri2. 

Let < ao ^ cKi < 1- Tor every a G [ao,ai], let a three-dimensional convex 
subset J(fa of M>Q be defined by 

Ri < ri — aai — (1 — 01)61, 
R2 <r2 - aa2 - (1 - a)b2, 

Ri+ R2 < ri2 - c, 
Ra + Ri+R2< roi2 - d 
and assume that J^a 7^ for every a. Then 

U J4 = jr, (12) 

where J(f is defined by 

Ri < ri - aoai - {I - ao)bi, (13) 
R2<r2 — aia2 - (1 - 011)62, (14) 
Ri + R2< ri2 - c. (15) 
Ro + Ri+R2< roi2 - d. (16) 
Proof (Lemma 4-1 )■ The proof is a direct application of Lemma 4.2 by setting 
r^=I{T AVi\V2U), r2^ I{T AV2\ViU), 

ri2=IiTAViV2\U), rm2 = I{T AV1V2), 

a^=I{Z AVi\V2U), a2=I{Z AV2\U), 

bi=I{Z AVi\U), b2 = I{Z AV2\ViU), 

(1) (1) 



We just need to show that the bounds (13) and (14) coincide with those from 
the definition of ^^^\p). This is easy for the case a^^ = because in that 

case we have I{T A V2|Vi?7) > I{Z A V2\ViU) and the positive part in the 
bound on Ri in the definition of ^^^^ (p) vanishes. Similarly a^^' = 1 implies 
7(T AVi\V2U) > I{Z A Vi\V2U) and the positive part in the bound on R2 in 
the definition oi M^'^\p) vanishes. Now assume that a^^^ > 0. This assumption 
implies I{Z hV2\ViU) > I{T AV2\ViU). Thus we obtain for the equivalent of 
(13) 



I{T hVi\V2U) - I{Z AVi\U) 

_ I{T A V2\ViU) - I{Z A V2\ViU) 
~ I{Z AV2\U) - I{Z hV2\ViU) 
■■ I{T AVi\V2U) - I{Z AVi\U) 

I{T AV2\ViU) ~ I{Z AV2\ViU) 



{I{Z hVi\V2U) - I{Z hVi\U)) 



{I{Z A V2\ViU) - I{Z A V2\U)) 



I{Z AV2\U)- I{Z A V2\ViU) 
= I{T AVi\V2U) + liT AV2\ViU) - liZ AViV2\U) 
= I{T AVi\V2U) - I{Z AVi\U) - [I{Z AV2\ViU) - I{T AV2\ViU)] + . 

IfaW<l , we obtain the analog for the bound on R2. This shows with Lemma 
4.2 that ^(i)(p) can be represented as the union of the sets ^i^^ (p) for a'^^ < 



For Case 2: Here we assume that I{Z A Vi\V2U) ^ I{Z A V2\ViU) which is 
equivalent to I{Z A ViU) ^ I{Z A V2U). In the case of equality, the achievability 
of M^'^\p) can be shown directly. Define for a e [ag^^a^^^] the rate set Ma\p) 
by the conditions 

Ri < I{T AVx\V2U) - aI{Z AVi\V2U), 

R2 < I{T A F2IV1I7) - (1 - a)I{Z A F2IV1C/), 
i?i + i?2 < I{T AViV2\U) - aI{Z AVi\V2U) - {I - a)I{Z AV2\ViU), 
Ro+Ri+R2< I{T A V1V2) - I{Z A V1V2). 

Lemma 4.3. We have that 

^^'\p) = U ^i'Hp)- 

(2)^ ^ (2) 

In particular, if ^a^{p) is achievable for every a G [ag^^a^^^], then so is 

Remark 4-4- The similarity between the rate regions for Case 1 and Case 2 be- 
comes clear in these decompositions. The description for Case 2 is more complex 
because a^^ and a^^ are defined through three minima/ maxima. This is due to 



the fact that the sum aI{Z A V1IV2C/) + (1 - a)I{Z A V2\ViU) is not constant 
in a. Hence the conditions for < cannot be reformulated into simple 
conditions on the corresponding p. 

One obtains Lemma 4.3 from the next lemma by making the following re- 
placements: 

ri=I{TAVi\V2U), r2 = HT AV2\ViU), 

ri2=I{TAViV2\U), roi2 = I{T AV1V2), 

a = I{Z AVi\V2U), h = I{Z AV2\ViU), 

c = I{ZAViV2), 

(2) (2) 

ao = ay, ai=al'. 

Lemma 4.5. Let ri,r2,ri2,roi2,a,b,c be nonnegative reals with max(ri,r2) < 
ri2 ^ ri+r2- Let ao, ai € [0, 1] be given such that for every a £ [ao, ai] the set 
J^a defined by 

i?i < ri — aa, 
i?2 < ^2 - (1 - a)b, 
Ri + R2 < ri2 — aa — {1 — a)b, 
Ro + Ri+ R2 < roi2 - c 

is nonempty. If a < b, the convex hull of the union of these sets is given by the 
set JXf which is characterized by 

< i?i < n - aoa, (17) 

< ii2 < r2 - (1 - ai)b, (18) 

-Ri + -R2 < ri2 - aia - (1 - ai)6, (19) 

bRi + aR2 < ri2a + ri{b - a) - ab, (20) 

Ro + Ri+R2< roi2 - c. (21) 

If a > b, the convex hull of the union of the sets is given by analogous bounds 

where a and b are exchanged in (20). 

The proof of Lemma 4.5 can be found in the appendix. 



4.2 How to Prove Secrecy 

Proving secrecy using Chernoff-type concentration inequalities (see Subsection 
4.3) is the core of Dcvetak's approach to the wiretap channel [17]. Due to the 
multi-user structure of the inputs of the wiretap MAC, we need several such 
Chernoff-type inequalities basing on each other compared to the one used by De- 
vetak (actually an application of the Ahlswcde- Winter lemma). However, once 
these are established, the way of obtaining secrecy is exactly the same as pre- 
sented by Devetak. With the help of the inequalities one obtains a code with 



stochastic encoding and a measure i? (not necessarily a probability measure!) 
such that for all ko,ki, k2 



||-Pz"|Mo=feo,Mi=fci,M2=fc2 ^ 2' ^^^-^ 

Given this, we now derive an upper bound on /(Z" /\ M0M1M2), where the ran- 
dom triple (Mq, Ml, M2) is uniformly distributed on the possible input message 
triples and represents the output received by Eve. Observe that 

/(Z" AM0M1M2) 

= ^ ^ ^ V {H{Z")-H{Z''\Mo = ko,M, = ki,M2 = k2)). (23) 
A0A1A2 , 'T^. 

By [16, Lemma 2.7], every summand on the right-hand side is upper-bounded 
by £feofcifc2 log(|^|"/£feofcifc2) if 

£/cofcifc2 II-PZ" - -f'z"|Mo=feo,Mi=fei,M2=fe2ll ^ 2' 

But due to (22), 

ll-Pz" — -Fz"|Mo=feo,Mi=fei,M2=fe2 II 

< ||Pxn - + 11^? - Pz"|Mo=feo,Mi=fei,M2=fe2ll 

- 1<7k7k\ ^ ll-^Z"|Mo=feo,Mi=fei,M2=fc; 



K0K1K2 ^ ^"\Mo=Ko,Mi=Kl,M2=lt2 " 2 



Thus if e tends to zero exponentially in blocklength, then (23) is upper-bounded 
by elog(|^|"/e) which tends to zero in n. 



4.3 Probabilistic Bounds for Secrecy 

In this subsection we define the random variables from which we will build a 

stochastic wiretap code in Subsection 4.5. For this family of random variables 
we prove several Chernoff-type estimates which will serve to find a code satisfying 
(22). For Case 3, two such estimates are sufficient. Case and 2 require three 
and Case 1 requires four. Within each case, one deals with the joint typicality 
of the inputs at Alicei and Alice2, and the other estimates base on each other. 
This is due to the complex structure of our family of random variables. Still, all 
the cases are nothing but a generalization of Devctak's approach taken in [17]. 
For each case, we first show the probabilistic bounds in one paragraph and then 
in another paragraph how to achieve (22) from those bounds. 

Let p = Pu (g) Px\u ® Py\u ®WEn, i.e. p is the distribution of a random 
vector ([/, X, y, T, Z). The auxiliary random variables V\ and V2 will be intro- 
duced later in the usual way of prefixing a channel as a means of additional 



randomization. Let S > and define for any n 



P^iui^l^) 



P^:uiTxiu/^)\^) 

p?{hiy\^) 



^Y\uy-^Y\U,5 



(u)|u) 



(xGTl|t;»,uGT^,,), 
(yeT^J|^,,(u),ueT^,,). 



Let Lo,Li,L2 be positive integers. We define Lq independent families of ran- 
dom variables {U''°,^ig) as follows. is distributed according to P^}. We 
let := : h G [Li],l2 G [^2]} be a set of random variables 

which are independent given U^" and which satisfy X'^'i ~ P^^^{- \ U''°) and 
yioh ^ pn|^( . |c//o). Finally we define 



ioe[io] 



(24) 



Throughout the section, let a small £ > be fixed. The core of the proofs of 
all the lemmas of this subsection is the following Chernoff bound, see e.g. [4]. 

Lemma 4.6. Let b > and < e < 1/2. For an independent sequence of 
random variables Zi,...,Zl with values in [0,6] with fii := E[X;] and with 



< exp I —L ■ 



ij2Zi>{l + e)n 
1=1 



1 ^ ^ ( 

- ^ < (1 - e)/i < exp ( 
;=i -I ^ 



2 

en 
26 In 2 



-L- 



2 

£ n 

26 In 2 



In order to obtain useful bounds in the following we collect here some well- 
known estimates concerning typical sets, see e.g. [16, Lemma 17.8]. Let {A,B) 
be a random pair on the finite Cartesian product sz^ x B§. Let ^, C > 0. Then 
there exists ac = c(|j2/||^|)>0 such that for sufficiently large n 



jjQ^n (rpn 



-BtAV-B|A,c(ar|a)<2-"^f . (25) 
Further there is a r = t{Pab,^, C) with r — >■ as ^, C ^ such that 

P||"^(b|a) < 2-"(^(s|^)-) if a G Tl^, b G T^i^,^ , (26) 



and that for n sufficiently large, 

IT^^I < 2"(^(^)+^), (27) 
\TB\Axi^)\ ^ 2"(-^(-^l^)+^) if a € T2,^. (28) 

We set 

c:= c(l^ll^ll^ll^l), 
this is the minimal c we will need in the following. 

Bounds for Case and 1: Let Lq, ^i, -^2 be arbitrary. Due to their conditional 
independence, the X'^'^ and Y^"^^ cannot be required to be jointly conditionally 
typical given U''°. However, the next lemma shows that most of them are jointly 
conditionally typical with high probability. 

Lemma 4.7. For {lojh) G [Lq] x [L2], let the event A^\lo,l2) be defined by 

Ai \lo, I2) 

:= {\{h e [Li] : e T^|y£/,^(r'°'^ t/'°)}| > (1 - £)(! - 2 • 2-"^^')Li}. 

Then 

P[Al''(/o,/2)1<exp -Li--^ ■ ^1 



21n2 / 

Proof. Let u e TJ}^ and y e T^n^^(u). We first condition on the event {F'"'^ = 
y, C/'o = u}. Due to (25), we have 



< 



In particular, 

/X := P[X" e T^|yy,5(y, u)|y" = y, = u] > 1 - 2 • 2""^*' 
Therefore 

P[Al'^(«o,«2)1i^'°'= =y,C/'° =u] 



< 



which by Lemma 4.6 can be bounded by 

exp -Li ■ < exp -Li ^ ' 



21n2y ~ \ 21n2 / 

This completes the proof as this bound is independent of (y, u). □ 

Lemma 4.7 is not needed for a single sender. As we cannot guarantee the 
joint conditional typicality of both senders' inputs, we need to introduce an 
explicit bound on the channel transition probabilities. This is done in the set 

^ Then we prove throe lemmas each of which exploits one of the three types 
of independence contained in ^ . Altogether these lemmas provide lower bounds 
on -^1) -^2 which if satisfied allow the construction of a wiretap code satisfying 
(22). Let 

£;W(u,x,y) := {z G r^|^t,,2|,^|,(y, u) : w^r(z|x,y) < 2-"W^i^^)-/^W)}, 

where = t{Puxy z,i5,5) (sec (26)). Let 

a?W(z) :=E[Wf"(z|X",y)l^a)(„,;,..,y)(z)|f/i =u] 

and for 

F«(u,y) := {z e T^^Yuamsij ■ <y(z) > £|I^z|yt/,2|^|5(y, u)!"^} 
define 

^« := . i;W(u,x,y) := E['\u,^,y) n F^'\u,y). 

Lemma 4.8. For every z G and {lojh) € [Lq] x [L2], let A^^\lo,l2,z) be 
the event that 



Then 

P[4')(;o,;2,z)=] < 2expf-Li ^j-^ 

for fi{S) = t{Puyz,^S,2\^\S) and n sufficiently large. 

Proof. For u e T{}g and y e T^^^g{u) we condition on the event {Y^oh = 
y, = u}. The conditional expectation of the bounded conditionally i.i.d. 
random variables 

T^f "(z|X'o^y)l^(„^^_^,^,^^^^(z) < 2-"W^I^^)-/^W) {I, e [ii]) 



is ■i?uy(z). We use Lemma 4.6, the definition oi '(u,y), and (28) to obtain for 
n sufficiently large 



< 2 exp I —Li ■ 



< 2 exp ( —Li ■ 



21n2 / 

g.32-n(7(ZAX|FC/)+/i(5)+/2(5)) 



V 21n2 
This bound is uniform in u and y, so the proof is complete. 
For the next lemma, define 

^W(z) :=E[W^f"(z|X",y")l^a,(„_^„_^,,)(z)|[7i =u]. 

Further let 

F«(u) := {z e nv,3i^ii^i5(") ■■ > ^\TS\u,3mmsi^)r'} 

and 

^i.'^ = ^L'^ • 4'^(u,x,y) := Ei'\u,K,y)nF^'\u,y). 

Lemma 4.9. For every z e and Iq G [Lq]? ^e* ^2^^(^o,z) be the event 

Then for e sufficiently small and n sufficiently large, 
P[4')ao,zn <2|^^|"expf-Li 
+ 2 exp I —L2 



21n2 

£32-n(/(2Ay|C/)+/i(<5)+/4(<5)) 



41n2 

where f^S) = t{Puz,S,3\^\\^\6). 

Proof. Let u e T^,,. We define the set c {T^iu,si^))^^ as 



One has 



P[A«(Zo,zri?7'°=u] 
< ¥[{{X^°\...,X^°^') ^ B^}\U'" = u] 

+ P[4^^(^0,Z)"|^'°' =x\...,X'''^i =X^i,J7'° =u]• 

(xl,...,xi'l)6Bu 

•P[X'oi = x\ . . . , X'o^i =x^i|i7''' =u]. 
From the proof of Lemma 4.8 it follows that 

P[{(X'''\...,X'°-^i) ^Bu}|f/'° =u] 

<2|^rexp(^-Li ^^-^ j, (29) 

which gives a bound independent of u. Now let (x^, . . . , x^^) e -Bu. By (25) and 
(26), 

^W(z) = E[W^r (^l^",y) V(„^^..,y)(z)|C/i = u] 

< E[VKf"(z|X",y)|C/i =u] 

^ Pir„(T^;„,,(u)iu) '^^"-''"''-i>'''" 

< (1 - 2-"=*^)-i2-"(^(^l^'^)--''iW). 
Hence the random variables 

h 

which are independent conditional on {U^° = u}, are upper-bounded by 



(1 _ 

For their conditional expectation we have 



. 2-niH{Z\YU)-fiiS))_ 



G [{l±e)E[S%^,^{z)\U'=u]] = [(l±£)C^(z)]. 



Thus their arithmetic mean = (1/^2) X];^ ^'0^2 must also be contained in 
[(1 ± £)'i9u ^(z)]. Applying Lemma 4.6, we conclude 



^E^-(«0,/2)^[(l±3£)^«(z) 



L2 



= u 



< 



jjlo 



U 



< 2exp 



^(1 -2-"'"^')2"'-"'^l^''''--'''''^"(l -^J'^u^z) 
2(1 + £) In 2 



Due to the definition of F2^\u) and to (28), this is smaller than 



2 exp I -L2 ■ 



g32-n(/(ZAy|[/)+/i(5)+/4(<5)) 



4 In 2 



(30) 



if £ is sufficiently small and n is sufficiently large, giving a bound independent 
of u and x^, . . . , x^^ . Adding the bounds (29) and (30) concludes the proof. □ 

The next lemma is only needed in Case 1. Let A'^\z) := A2^-*(l,z) n . . . D 
A2'\Lo,z). For every z, we then define a new probability measure by P^^' := 
P[-|4^^(z)]- With 7?(i)(z) := Ei^\^^^l{z)] define 

Fq ^ := {z e T'z,4|3'||ir||<ar|5 '■ ^'•"^■'(2) > \Tz,4\'3^\\s:\\^\s\ ^} 
andi?(i) := -l^d). 

Lemma 4.10. Let z G Fq^^ and let A(^\z) be the event that 

j-^^ E W^e®"(z|^'°'S>''°'^)l4^)(a.o,X<o..,r<o..)(^) e [(1±5£)1?(1)(Z)]. 

Then for f6{6) = T[Pz-,^\'3^\\S^\f^\^-,S), sufficiently small s and n sufficiently 
large, 



P[A«(z)^] 
< 2Xo|^rexp (^-Li 

+2Lo exp ( -L2 ■ 

+2 exp 



g.32-n(/(ZAX|ri7)+/i(5)+/2(5)) 

21n2 

£32-n(/(^AY|C/)+/i(5)+/4(<5)) 



4 In 2 

/ g32-n(/(ZAC/)+/4(5)+/6(5)) 

I -Z/Q • 



41n2 



Proof. We have 

P[4^)(z)^] < Pii)[AW(z)^] + P[4'^(z)1- (31) 
By Lemma 4.9, for e sufficiently small and n sufficiently large, 

P[4 '(z)1 < 2Lo|^rexp -Li 



2 In 2 , 

g32-"(/(2Ay|C/)+/i(<5)+/4(5))^ ^ ^ 

+2Loexp ( -L, 



In order to bound P^^^ [AJ,^^ (7)^=], note that the sets A^^\l,7.),.. .,A^^\Lo,7.) are 
independent with respect to P. Thus under Pi^', the random variables 

retain their independence and are upper-bounded by 

{1 + 36) max ^W(z). 

We can further bound this last term as follows: for u e T^^, applying (25) and 
(26), 

^W(z) =E[H^f"(z|Xi\F")l^a,(„,^..,y..)(z)|t/^ =u] 

<E[T4^f"(z|X",y")|i7i =u] 
1 



< 



pr(T",^,(u)iu)pr(r^^,^.(u)iu) ^1^^ ' ' 



< (1 - 2-"'^i''^)-22-"(''^(^l'^)--''''('')). 

Observing that ]Ei^^[wi^^(l)] e [(1 ± Se)!?'!^^)] and applying Lemma 4.6 and 
(28) in the usual way yields 

/ £32-n(/(ZAi7)+/4(5)+/6(5)) 

- ' '^"P (,-^° 4h^2 

if s is sufficiently small and n sufficiently large. Inserting this and (32) in (31) 
completes the proof. □ 

We finally note that results analogous to Lemma 4.7-4.10 hold where the roles 
of X and Y are exchanged. We denote the corresponding events by Ai^\lo, I2)' 
and A^^^ {lo, I2, z)', 4'^(^o, z)', 4'^^)'. 



Secrecy for Case and 1: The following lemma links the above probabilistic 
bounds to secrecy. In the next subsection, roughly speaking, we will associate 
a family ^ to every message triple {ko,ki,k2). If Lo,L\,L2 are large enough, 
the bounds of Lemma 4.11 are satisfied for every such ^ with high probability. 
Hence there is a joint realization of the ^ such that the statement of the lemma 
is satisfied for every message triple. By an appropriate choice of random code 
one then obtains (22). 



Lemma 4.11. Denote by p*^^-* the hound on P[j42 (?0jz)^] derived in Lemma 
4.9. Let {u'o,x'o'i,y'o'2 ; {l^^l^^l^) e [Lq] x [Li] x [La]} be a realization of ^ 
satisfying the conditions of 



Then 



n n 4'^Go,^2,z), 



lo zeiT" 



(1) 



(33) 
(34) 
(35) 
(36) 



(i)_^_ M^®"(.]x'«'\y'«'^)]| < 20e + 9-2-"'='^' +Lo|ir|Vi) 

L0L1L2 ^ 

t05tl,t2 



The same inequality is true if we require conditions (33')-(36') which contain the 
primed equivalents of (33) -(36) defined at the end of the previous paragraph. If 
Lo = 1, then (36) and (36') do not have to hold. 



We now prove the above lemma. We have 
11^(1) E W^e^"(-|x'°'Sy'°'^)|| 

^ "^^'^ - ^ w^e«"(•l-'°^y'"'^)l4^)(u'o,xM.,.M.) (37) 

+ ^ ^e^"(-|-'°'Sy'"'^)l4^)(u'o,x<o<.,yo<.)(l-l^a))|| (38) 

+ 5Z W^e^"(■|^'''^y''''^)li.«(u^o,x^o^.,y^o<.)(l- V^Ko))ll (39) 

" LqLiL2 ^ ^e^'^('l^^°^^'y^^^^)-'-Ej^\u^o,x^oii,yio'2)(^ ~ ^F^^^^ (u'o ,yioi2 )) II 

^0 1^1 1^2 

(40) 

+ ^ w/r(-|x'°'Sy'°'^)(i-i^a.(„<o,x.o<.,,,c<.))ll- (41) 

Due to (36), we know that (37) < 5e. 

Next we consider (40). Due to (34) we have 

(40) 

<1__L_ Y W^f"(4^'(u'°.x'°'\y''''')|x''''Sy''''^) 

(wc defined the general measure of a set in the notation section at the beginning 
of the paper). The support of i^^^Voyioia is contained in T^\yu 2\s:\5iy^°''^ ^'^^°)^ 
by the definition of i^^^^''(u'", y''''^) we obtain 

^L'4'o'2(^")><'4,o<.(^")-e. (42) 

Lemma 4.12. 7/u e TJ}^^ and y G T^|y_^(u), then 

i9W(^") > 1-2-2-"^*'. 
Proof. First of all note that 

= E[W^f"(^«(u,Xii,y)|Xii,y)|f/i=u] 

> nWf^{E^'\n,X'\y)\X'\y)-X'' e T_J|^^_,(y, u)|[/i = u]. (43) 



Now we claim that for x G T^\Yusiy^ ^) 

^Z\YXU,S {y,x,u) cT^\YU,2\sr\siy,'^)- (44) 
To verify this, let {z,y,u) € ^ x ^ x and z e T^^y^^g{y,x,u). Then 

^N{z,y,u\z,y,u} - Pz\Yuiz\y,u)^N{y,u\y,u] 



< 



E 



-N{z,y,x,u\z,y,x, u) - W{z\x,y)-N{y,x,u\y,x, u) 
n n 



X 

< 2\^\6. 



^N{y,x,u\y,x, u) - PxiYu{x\y,u)^N{y,u\y, u) 



This proves (44). Due to the choice of f2{5) and to (26), wc thus sec that 
T^|yj^j^^(y,x, u) is contained in i?^"^^(u,x,y) for x € T^|yy^(y,u), and we 
have that (43) is lower-bounded by 



'(?^ziyxc/,^(y,^",u)l^''>y);^"erjj|Fc/,.(y,u)|c/^ = u]. (45) 

Further, as in the proof of Lemma 4.7 one sees that 



¥[X'' G T^^YuAy^ = u] > 1 - 



-nc5 



-ncS'^ 



(46) 



Due to (46) and (25), we can lower-bound (45) for sufficiently large n by 

2" nc(5^ 



(1-2-"^*") • ( 1 - 



> 1-2-2 



-nc5 



which proves Lemma 4.12. 

Using (42) and Lemma 4.12 we can conclude that 

(40) < 2(£ + 2-"^*'). 
One starts similarly for (39). We have by (35) 



□ 



(39) < 1 - ^ V M/®"(i;(i)(u'«,x'o'Sy'°'^)|x'o'Sy'«'2) 
L0L1L2 ^ 

<i-^^E^iV„(^"). 



As the support of 'd^^^ is contained in T'^|c/3|gr||^|5(u'°), we can lower-bound 
^uVo (^") by /Vo (^") - £• Using (42) and Lemma 4.12, we have 

i^u<o (^") = lE[#Vo^ii(^")|?7' = u'°] > 1 - 2 • 2-"^*' 



- e, 



(47) 



so we conclude 

(39) < 5e + 2 ■ 2-"-'=^\ 

For (38), one has by (36) 

(38) <1-—^— y Wf"(£;^^^(u'»,x'«'\y'"'^) nF(|^'|x'°'%y''''') 
L0LIL2 ^ 

It remains to lower-bound i?^^-* (Jq^''). Observe that the support of t?'^' is re- 
stricted to 7^ 4|3^||^||<2/|5) so due to the definition of -Fo^\ one hasi?(i)(i^o^'^) = 
t?(i)(Fo^^^) > t?(i)(^") - e. Further, 

t?(i)(^")= ^ eW[^(;)(z)] 

>E[e«(^")]- 5^ P[A«(z)1 

zGiT" 

= E[0[,\)(ir")]-Lo|^|V^. 

In (47), the integrand of E[6'[;^i^(^")] was lower-bounded by 1 - 2 • 2""^*" - £. 
We conclude 

(38) < 7e + 2 • 2-"^*' io|ir|>(i). 
Finally, we use condition (33) to bound (41). We have 

(41) (48) 
= 3^ V VF®"(i;f^(u'°,x''''Sy''''^)'=|x'o'Sy'o'2) 

J_ ^ M^f"(£;W(u'°,x'°'Sy''''2)'=|x'°'Sy'°'=^) (49) 

_^J_ ^ VP"f"(i;f^(u'°,x'«'Sy'"'^)"|x'°'Sy'°'^) j. (50) 

^ ii:x'oii^T^l^j^^(y<o'2,u!o) 

For every (^0,^2), we use r||^^y ,5(y, x, u) C i;f^(u,x,y) for (u,x,y) e T^,, x 
r^|y^(u) X TJ|yj^^(y,u) as shown in the proof of Lemma 4.12 to upper-bound 
the term in (49) by 2""'^*^. For (50), we know from assumption (33) that it is 
at most 1 - (1 - e)(l - 2 • 2""^*"). Thus 

(41) < 2""^*' (1 - £)(1 - 2 • 2""'=''') < £ 3 ■ 2""'='^'. 



Collecting the bounds on (37)-(41), we obtain a total upper bound of 



This finishes the proof of Lemma 4.11. 

Bounds for Case 2: Now we specialize to the case that L2 = 1, but Lq and Li 
arbitrary. This reduces the number of Chernoff-type estimates needed by one. 

Lemma 4.8 carries over, Lemma 4.9 is not needed, but Lemma 4.10 changes. 
We write =: y'". The definitions of £;|^^(u,x,y),Fi^^^(u,y) and i^LV carry 

(2) (2) (21 

over to this case, wc just call them E\ (u, x, y) , (u, y) and i?uy • Further we 
define 



4')(u,x,y) := £;f)(u,x,y) ni^f )(u,y). 
For every /q, let Af\lQ,7) := a'^^\Iq,1,7.) and we set ^f^(z) := Af'(l,z) n 




Further let 



and 



-''0 



Lemma 4.13. Let z e Fq ' . Let Aq ^(z) he the event 



l_^l^«n(z|X'°\F'o)l^(.,(^,„_^,,,^_^,„)(z) e [(l±3s)^(2)(z)]. 



T/ien for e sufficiently small and n sufficiently large, 




Proof. We have 




(51) 



By Lemma 4.8, we know that 



In order to bound Pi^' [A^^^ (z)], note that the sets A^^^ (1, z), . . . , A^^^ (Lg, z) are 
independent with respect to P. Thus under P^^^ , the random variables 

h 

retain their independence and are upper-bounded by 

(1 + e) max max i?,vJ(z). 

Wo can further boimd this last term as follows: for u € T^^ and y € Ty^u^iu) 
one obtains by (25) and (26) 

¥^^{z) < E[W^^{z\X'\y)\U'" - u] 

< 1 o-n(g(Z|rC/)-/iW) 

Observing that Ez[W'i^''(l)] & [(1 ± e)i?^^^(z)] and applying Lemma 4.6 in the 
usual way yields 

(2)/„M /o„.„ r e2(l-2-"^^')2"W^I^^)-/^W)(l-e)i?(2)(z)^ 



J^^^'(z)] <2exp|^-Lo 
< 2 exp ( —Lq 



2(1 + e) In 2 

g:i2-»(./(:z' r( 'I-/!!, )!-/,, (5)) 

41n2 

if e is sufficiently small and n sufficiently large. Inserting this and (52) in (51) 

completes the proof. □ 

Again we note that a result analogous to Lemma 4.13 holds where the roles 
of X and Y are exchanged. Setting A^^\lo) := Ai^\lo, 1), we denote the events 

j'2\ ['2') (2,^ 

corresponding to such an exchange by Al {lo)' and A\ '{lo,zy,AQ (z)'. 
Secrecy for Case 2: 

Lemma 4.14. Denote by p'^^^ the bound on F[A^^\lQ,zy] derived in Lemma 
4.8. Let {u'o,x'o'i,y'o : {lo,h,l2) £ [Lo] x [Li] x [L2]} be a realization of ^ 
satisfying the conditions of 

lo 

fl fl 4'^(/o,z), (54) 
lo zear^ 

n ^o\^)- (55) 



r\^^^\lo), (53) 



Then 

||#2) _ y Wf "(•Ix'^'i.y'")!! < 9e + 7 • 2""'=^' + Lo| V^. 

T/ie same inequality is true if we require conditions (53')-(55') which contain the 
primed equivalents of (53) -(55) defined at the end of the previous paragraph. 

We use this subsection to prove the above lemma. We have 

+ IIZ^E^e®"(-|'^'°^y'°)li.P>K0,.M.,y<0)(l- V^K0,y<0))ll (58) 

+ ll;^E^e^"(-|^'"^y'°)(l - VK0,x<0..„<0))II- (59) 

Due to (55), we know that (56) < e. 

Next we consider (58). Due to (54), we have 

(58) < 1 - — y H^f " (4^^ (u'° , x'°'S y'« ) |x'«'\ y'» ) 

lOjll 

<i-^E^SU(^")- 

As for Case 3, one lower-bounds ^'^1^,^ (^") > i?„?oy,o (^")-e by 1-2-2-"'^''"- 
e. Thus we can conclude that 

(58) < 2(£-F2-"^*'). 

For (57), we have by (54) 

(57) < 1- --Vy"^e®"(4^^(u'°>x'°'\y'°)nF(|'V°'':y'°) 

LqLi f-f 

< 1- (l-3£)l?(2)(i;^g(2)). 

It remains to lower-bound i?^^^ (Fg'^' ) > i?(^)(^") — s. As in the lower bound on 
^(i)(_g°") above, one obtains the bound 

> 1-2-2-"^''' -e. 



Thus we conclude 

(57) < 5e + 2-2-"'^'''. 
Finally, we use condition (53) to bound (59). We have 



(59) = W^e®"(^^f^(u'^x'°'^y'°)|x'«'^y'«) 
LqLi f-f 

^j_Y^fl. j2 w-f"(£;f^(u'^x'°'^y'o)|x''''^y'°) (eo) 

J2 Wf"(i;f^(u'°,xWSy'<')|x'°'\y'«)Y (61) 

'n I. .In ' 



1 

ii:x'o!i^T^I^^_^(y!o,u'o) 



For every /q, the summand appearing in (60) can be upper-bounded by 2 '^'^^^ . 
By assumption (53), (61) is upper-bounded by 1 - (1 - £)(1 - 2 ■ 2""^*'). Thus 

(59) < e-K3-2-"^*'. 
Collecting the bounds for (56)- (59), we obtain a total upper bound of 

This finishes the proof of Lemma 4.14. 

Bounds for Case 3: Now we treat the case L\ = Li = \. Lemma 4.15 is the 
analog of Lemma 4.7, the proofs are analogous. 

Lemma 4.15. Let the event Aa, he denned by 

A^'^ ■■= {\{lo e [Lo] : X'" € 21|yc,,5(F'°,t/'°)}| > (l-£)(l-2.2-"«^')Lo}. 
Then 

n{Ai"y] < exp ( -Lo 



.(3hci...,^/ . £^(l-2.2-^M 



21n2 / 
Let 

E('H^,y) := {z e nUl^ll^ll^l. : "(-|x,y) < 2-"(^(^l^^)-/= W)}, 
where f2{6) = t{Pxyz,55,S). Let 

/3)(z) :=E[iyf"(z|Xi,yi)lB,(xi,yi)(z)] 

and for 

define the measure 



Lemma 4.16. Let z e F^^). Let ^(^'(z) be the event that 

r/ien /or /i(<5) = r(Pc/rz, 4|$?^||^||'2^|J, 5), 

P[A(3)(z)^] < 2exp (^-Lo j . 

The proof of this lemma is analogous to that of Lemma 4.8. 

Secrecy for Case 3: 

Lemma 4.17. Let {(u'Ojx'^jy'")} be a realization of ^ satisfying the condi- 
tions of 

A^*\ (62) 

n ^^'H^)- (63) 

zeF(3) 

Then for sufficiently large n, 

||#^) - Vwf"(-|x'°,y'°)|| <4e + 5-2-"^*'. (64) 
Lq '—^ 

lo 

We use this subsection to prove the above lemma. We have 

||^(3)_ 1 ^|^«"(.|x'o,yo)|| 
° lo 

+ ll;^E^e®"(-|'^'°'y''')lj^<^>(x'o,y'o)(l-lF(3))|| (66) 

° lo 

+ ll;^E^e''"(-|^'"'y'°)(l - lB(3)(3,,o,y<0))||. (67) 



Due to (63) we have (65) < e. 

Next we bound (66). Again using (63), 



(66) < 1 - V Wf " (i;(3) (x'» , y'° ) n |x'o ^ y/o ) 
Lo , 

lo 

< 1- (l-£)i?(3)(i^(3)). (68) 



As in Case 1 and 2, ^(3)(f(3)) can be lower-bounded by 1 — 2 • 2 — e, so 
(66) < 1 - (1 - - 2 • 2-"""^^ - £) < 2{e + 2""'='''). 
Finally, the third term (67) equals 







° «o:x'oeTx|y[/,j(y'o,u'o) 

+ J_ ^ VFf"(i;(3)(x'a,y'a)^|x'°,y'°). (70) 

;o:xio^Tx|y!7,j(y'o,u'o) 

and is lower-bounded by 

(67) < 2""^*' -I- (1 - £)(1 - 2 • 2""'=''') < £ 3 ■ 2""'='''. 
Combining the above bounds, we can conclude that 

(65) + (66) + (67) < 4£ 5 • 2""^*', 
which completes the proof of Lemma 4.17. 



4.4 Random Coding for the Non- Wiretap MAC with Common 
Message 

Assume we are given another family of random variables 

^'■.= U (f/'o,^^) 

ioe[io] 

with J^/^ = {X'o'i , : /'i, e [L'l] x [V^]) for other positive integers L^, L'j 
with blocklength n' which is independent of but which has the same structure 
as ^ and whose distribution is defined according to the same p as J^. Define 
the rate set !%{p) by the bounds 

.Ri < I{T hX\YU), 
R2 < I{T AY\XU), 
Ri+R2< I{T AXY\U), 
Ro + Ri+R2< I{TAXY). 



Assume that for some < 77 < /* := mm{Ii, > : 1/ = 1, 2, 3, 4} we have 
n log L2 + n' log L2 



nlog(LiL2) +n' log(L;L^) 

n + n' 

nlog{LoLiL2) + n' \og{L'oL[L'2) 



<[IiTAY\XU)-v]+, 

n + n' 

''''^ <[I{TAXY\U)-v]+, 



<[I{TAXY)-r]]+. 



n + n' 

Define a new family of random vectors 

by concatenating the corresponding elements of ^ and , so e.g. [/'"'o = 
(J7'°,C/'o) e '^"+"', X'^'o'i'i = , X'o'i) g ^"+"'. 

Lemma 4.18. For any S,r] > there are (1,(2 = CiiVt <5)) C2('7, S) > such that 
the probability of the event ^mac that the family 

is the codeword set of a deterministic MAC code with average error at most 

exp(— (n + n')Ci) lower-bounded by I — cxp(— (n + n')(^2)- The same result is 
true if it is formulated only for or J^' without concatenation. 

Proof. The difference to standard random coding proofs is that the random 
variables from ^ and are conditioned on typicality. Using the random sets 

we define the decoding sets F'o'o'i'i'2J2 by deciding for (/q, /q, ^i, i'l, ^2, ^2) if ttie 
output is contained in £;'o'o'i'i'2'2 and if at the same time it is not contained in 
any £''o'o'i'i'2i2 for a different message tuple {lo,l'^Ji,l[J2J'2)- This decoder is 
known to be the right decoder in the case where the codewords have the standard 
i.i.d. structure, i.e. for a family of random variables 

^jj^O^'o j^lo^ohl'i ^^0^0^2^2| 

where U'°'^'o - p®("+"') and where conditional on [/'"'o, the and Y'^'o^^''^ 

are independent with X^oi'ohi'i ^ p|(^'+"') and Y^ol'0121'2 _ it is easily 

seen that 



-^^^r^n^^plol'olll[l2l'2y^j(|lol'ohl'l ^ y'io'o'2(2^j 

^ _ 2-nc(5^'j3^2 _ 2~"''^''^)'^]E|^®"^(^p'o'o'i''i'2'2^c|^ioidli''i y'io'o'2i2^J 

Then the standard random coding proof technique yields the result. The spe- 
cialization for the case that only ^ or is treated is obvious. □ 



4.5 Coding 



In this subsection we show the achievabihty of the rate sets ^^"^p) for v = 
0, 1, 2, 3 and appropriate p. For the cases where we showed that ^^''\p) can be 
written as the union over certain a of rate sets (p), we show the achievabihty 
of the latter for every a. 

Throughout this section fix a common randomness bound He > 0. Let ^ > 
which will be specified later and n a blocklcngth which will have to be large 
enough. Every p considered in this section has the formp = Pu(^{Px{u'^Py\u)® 
W. Without loss of generality we may assume that I{Z A XY) < I{T A XY), in 
particular, I{T A XY) > 0. Letting 

Ko,Ki,K2,Lo,Li,L2,n, K'Q,K[,K'2,L'Q,L[,L'2,n' (71) 

be arbitrary positive integers, we define two independent families of ran- 

dom vectors. has the same form as with the parameters Lq, Li, L2 replaced 
by KqLq, KiLi, K2L2- ^' is defined analogously with the parameters on the 
left-hand side of (71) replaced by those on its right-hand side. Every choice of 
(fco, ^1,^2) induces a subfamily ^ of which has the same parameters as the 
^ treated above, every subfamily of corresponding to any (fcg, k[,k'2) induces 
an with parameters Lg, L[, L'2,n'. Further recall the notation o^' as the 
family of concatenated words from and 'S' . 

Case and 1: Let p G ilg or p e ^'h'c ' ■'^^te that a^^'' < a^"^ if and only if the 
vector {Jq"\ J 2^'') whose components are given by 

=/(ZAC/), 
j}") = aI{Z A X\YU) + (1 - a)I{Z A X\U), 
= aI{Z A Y\U) + (1 - a)I{Z A Y\XU) 

is contained in .'^{p). We first consider Case 1. Let a rate vector {Rq, Ri, R2) 
with positive components be given such that {Rq, Ri, R2) := {Rq, Ri, R2) + 
(J^"\ J^"\ J^"^) e ^{p), which means that (i?o, i?2) € ^a{p)- We now 
define a wiretap code whose rates approximate {Rq, Ri, R2). If a = 0, we only 
need if a = 1, we only need Otherwise we do time-sharing in the following 
way: choose for a small < 7 < min{a, 1 — a} blocklengths n and n' with 
n/(n + n') G (a — 7, a -|- 7). For some < 2r] < min{i?o, ^^2} and every 
u = 0, 1,2 let 

- ^ log(j^.L.)+log(K^L;,) ^ - 

n + n' 2 

(and this modifies accordingly for a G {0, 1}). By Lemma 4.18 we know that 
with probability exponentially close to 1, the random variables ^kgklkik[ ^^'^ 
^klk'^klk' form the codewords of a code for the non-wiretap MAC given by Wb 



with an average error at most exp(— (n + n')Ci) for some Ci > 0. We denote 
Bob's corresponding random decoder by ^. Now let 



A"^ + (/i(<5) + («/2(<5) + (1 - a)U{6))) ■ [2,3], 



log Li + log L[ 
n + n' 

e Ji«) + {M6) + iaUiS) + (1 - a)/.(5))) . [2,3], 
i^^^^^^eJ^") + (/4^) + /e(^)).[2,3]. 

This is possible if 4(/i(5) + /2(^) + fi{6)) < min{r?, i/c - ^o"^}- If additionally 
e is chosen according to 

~loge=^ min{4Ci, fi{5) + f2{5) + U{5) + U{5)}, 

then for every (fco,fci,fc2) G [K^] x [Ki\ x [-^^2], the corresponding subfamily 
=^ of satisfies (33)-(36) with probability exponentially close to 1, and for 
every (fcg,fci,fc2) G [K'o\ x [-f'^i] x [-f'^2]7 the corresponding subfamily of 
satisfies (33')-(36') with probability exponentially close to 1. Thus wc can choose 
a realization of o which has all these properties and use it to define a 
stochastic wiretap code. We define independent encoders G and G' by setting 

Go{h\ko) = ^, {ko&[Ko],h&[Lo]), 
^0 

Gi(x|fco,A;i,/o) = i^y^^x'o'i (x), (x e e [i^i],A;o G [i^o],/o G [^o]), 

G2(y|fco,fc2,/o) = i^E'^v'"'^ (y)' (y e ^"'^2 e [K2],ko G [iro],;o e [Lo]), 

and defining G' analogously. Go and Gq satisfy the common randomness con- 
straint. We choose the decoder ip to be the realization of <!> corresponding to the 
chosen realization of o^'. The average error of the stochastic encoding code 
equals the average error of the deterministic MAC code for Wb determined by 
the realization oi'S o'S' ^ in particular it is bounded by e. Due to the choice of 
5 the rates of this code satisfy 

log + log ' n 1 o \ 

■ — >R^-2t] (i/ = 0,1,2,). 

n + n' 

Finally if we let M^, be uniformly distributed on [K^] and on [K^,], then 
it follows from Lemma 4.f f and (22) together with the fact that e is exponen- 
tially small that the strong secrecy criterion is satisfied. Thus the rate triple 
{Ro,Ri,R2) is achievable. So far, this excludes (i?o, -Ri, -R2) where one compo- 
nent equals zero, but as S and rj may be arbitrarily close to and the achievable 
region of W is closed by definition, we can conclude that the whole region ^a{p) 
is achievable. 



For Case 0, everything goes through if one sets Kq — K'q = Lq = Lq = 1 
and Ro = Q. The difference to Case 1 is that even if J^"^ = 0, one needs a Uttle 
bit more common randomness than that in order to protect a common message, 
as can be seen in the choice of Lq and Lq above. Thus the transmission of a 
common message is impossible if common randomness is not available. 



("2) 

Case 2: Let p G n^^. In this case we generally need both a and a where 
^ has L2 = 1 and ^' has Li = 1. We define the vector (J^"\ J^"^) by 

J^«) = aI{Z A YU) + (1 - a)I{Z A XU), 
Ji*"^ =aI{Z AX\YU), 
4°'^ = {I - a)I{Z ^Y\XU) 

As it should always be clear which case we are treating, this should not lead to 
confusion with case 1. Note that a^^^ < a < Oi{^ if and only if (Jq"\ J^"\ Jg"') 

is contained in M{p) and satisfies Jq"'' < He- Let a rate vector {Rq, Ri, R2) be 
given whose v-th component may only vanish if L,^ = L'^ = 1. Further we require 

that {Ro,Ri,R2) = (i?o, -R2) + ^2"^) is contained m^{p). If a = 

0, wc only need if a = 1, we only need (f. Otherwise, let < 7 < minja, 1— a} 
be small and let n and n' be large enough such that n/ (n + n') € (a — 7, a + 7). 
Further for some < 2r] < min{R„ : v = 0,1,2, R^ > 0} let 

and modify this accordingly for a G {0, 1}. By Lemma 4.18 we know that 
with probability exponentially close to 1, the random variables and 

^klk^k2k'2 form the codewords of a code for the non- wiretap MAC given by W(, 

with an average error at most cxp(— (n + n')(i) for some (i > 0. Wc denote the 
corresponding random decoder by <1>. We define = 02)^1) = (1)2) and 

(io>io) = (1) 6). Then let for u = 0,1,2 

which is possible if 4(/ji {S)+fj2 (6)) < minj??, Hc — Jq"^} for all v. If additionally 
s is chosen according to 

-- log£ = i min{4Ci, + f2{6), M6) + h{S)}, 
n 4 

then for every {ko,ki,k2) G [Kq] x [Ki] x [K2], the corresponding subfamily 
^ of $f satisfies (53)- (55) with probability exponentially close to 1, and for 
every {k'Q,k[,k'2) e [Kq] x [K'j] x [K2], the corresponding subfamily ^' of ^' 



satisfies (53')-(55') with probability exponentially close to 1. Thus we can choose 
a realization of o which has all these properties plus tliose defining Amac 
and use it to define a stochastic wiretap code. We define independent encoders 
G and G' by setting 

Go{lo\ko) = ^, {loe[Lo],ko€[Ko]), 

J-'O 

Gi(x|fco,/ci,«o) = ^E^x'o'i (x), (xe e [Ki],ko e [Ko],h G [Lo]), 



G2(y|A:o,fc2,/o) = <^ <o (y), (ye^",A:2e[if2],fcoe[i^o],/o€[i^o]), 

and defining G' analogously. The decoder Lp is the realization of corresponding 
to the chosen realization of o Go and Gq satisfy the common randomness 
constraint. Due to the simple form of G and G', the average error of the stochastic 
encoding code equals the average error of the deterministic MAC code for Wh 
determined by the realization of o in particular it is bounded by e. Due to 
the choice of 5, the rates of this code satisfy 

log iTi. + log if ' n 1 o \ 

■ — >R^-2t] (i/ = 0,1,2,). 

n + n' 

Finally if we let M^, be uniformly distributed on [K^,] and on [K^,], then 
it follows from Lemma 4.11 and (22) together with the fact that e is expo- 
nentially small that the strong secrecy criterion is satisfied. Thus the rate triple 
{Ro, R\,R'2) is achievable. So far, this may exclude rate triples (i?o, -R2) where 
one component equals zero, but as 5 and 77 may be arbitrarily close to and the 
achievable region of W is closed by definition, we can conclude that the whole 
region ^a{p) is achievable. 



Case 3: In this case we only need ^ with Li = L2 = 1. Let i?o > and assume 
that the rate vector (i?o, -Ri) -R2) := {Ro + I{Z A XY),Ri,R2) is contained in 
J'(p). Further for some < 2?? < min{ii^ : = 0, 1, 2, i?^ > 0} let 

[R. -??]+<- \og{K,L,) < [R, - + . 

n 2 

'S satisfies v4mac with probability exponentially close to 1, so the X^^lki ^^"^ ^?sofc2 
form the codewords of a deterministic non-wiretap MAC code whose average 
error for transmission over is bounded by exp(— nCi) for some Ci > 0. We 
denote the corresponding random decoder by ^. Now let 

I{Z A XY) + 2(/i(J) + hm < - logLo < HZ A XY) + 3{.h{6) + /a ((5)) 

n 

for 6 so small that 4(/i((5) + /2(5)) < min{r],Hc — I{Z AXY)) and choose e such 
that 

-- log£ = ^ min{4Ci, h{S) + f2{d)}. 
n 4 



Then for every (^0,^1,^2) the corresponding family ^ satisfies the conditions 
(62) and (63) with probabihty exponentially close to 1. Wc choose a realization 
{(uj?jj,xj?^j^^,yj.°^^^)} which satisfies the conditions of (62) and (63) and which 
determines a deterministic non-wiretap code for W(, with decoder Now we 
can define a wiretap code whose decoder is and whose stochastic encoder G is 
given by 

Go(Zo|fco) = ^> (/coG[i^o],/oe[io]), 
Giix\ko,ki,lo) = 6^:o (x), {xG ^'',kiG[Ki],koG[Ko],lo&[Lo]), 

kQki 

G2{y\ko, k2, lo) = S,o (y), (y e ^2 e [K2],ko g [Ko], lo e [Lo]). 

Note that Go satisfies the common randomness constraint. Due to the uniform 
distribution of Go, its average error is identical to that of the deterministic MAC 
code determined by the ^koki yfeofc2' ™ particular, it is exponentially 

small with rate at most s. We have for = 0, 1, 2 

-\ogK,>R^-2rj. 
n 

due to the choice of 5. Finally if we let M,y he uniformly distributed on [K^], 
then it follows from Lemma 4.17 and (22) together with the fact that e is expo- 
nentially small that the strong secrecy criterion is satisfied. Thus the rate triple 
(i?0 5 -Ri, -R2), and hence ^{p), is achievable. 

4.6 Concluding Steps 

Wc can reduce coding for a general p which is the distribution of a random vector 
{U,Vi,V2,X,Y,T, Z) to the case treated above by constructing a new wiretap 
MAC as follows: its input alphabets are and 1^, its output alphabets still 
are ^ and 2f. The transition probability for inputs {vi, V2) and outputs {t, z) is 
given by 

W{t,z\vx,V2):= W{t,z\x,v)Px\vAA-vi)PY\vAy\'"2). 

For this channel we do the same construction as above considering the joint 
distribution of random variables [U, Vi, V2,T, Z) which wc denote by p. In this 
way we also construct a wiretap code for the original channel W because the 
additional randomness PviV2\u can be integrated into the stochastic encoders G\ 
and G2. Go remains unchanged, so the additional randomness in the encoders 
does not increase the common randomness needed to do the encoding. 

On the other hand, we need to show that the rate regions thus obtained are 
those appearing in the statement of Theorem 3.1. As the sets iTo, U^h]^ 
depend on the channel, we write i7o(VF), no{W), n^^l [W), (W). Note 
that p is contained in 7To(W^) or (^) fo'" some = 1, 2, 3 if and only if p is 

contained in the corresponding no{W) or il^^(M^). This immediately implies 
that the rate regions also coincide. 



5 Proof of Theorem 3.5 



5.1 Elementary Rate Regions 

As for the wiretap MAC with common message we show that we can write the 
claimed achievable regions as unions of simpler sets whose achievability will be 
show in the next step. 

For Case 1: Define 

We have < Pi^' because I{Z A C/) < Ci + Ca- 

Lemma 5.1. For jS^^^ < P < Pi'\ let ^f\p,Ci,C2) be the set of those real 
pairs (i?i,J?2) satisfying 

Ri < I{T AVi\V2U) - I{Z AVi\U) 

- [I{Z A V2\ViU) - I{T A V2\ViU)]+ - (31 {Z AU) + Ci, 
R2 < I{T AV2\ViU) - I{Z AV2\U) 

- [I{Z AVi\V2U) - I{T AVi\V2U)]+ - {1-(3)I{Z AU) + C2, 
Ri+R2< min{7(T A ViV2\U) - I{Z A ViV2\U) - I{Z AU) + Ci+ C2, 

I{T AV1V2) - I{Z AV1V2)]. 

Then 

^«(p,Ci,C2)= U Mf{p,CuC2). 

Thus it is sufiicient to show the achievability of ^^^^ (p, Ci, C2) for every /3. 
For the proof one uses Lemma 4.2. 

For Case 2: Recall the vector ( Jq"'*, Jj"'*) defined as in Case 2 from the 
common message part. Define 

Po — [l--(^J + > Pi — 

(2) 

We show that every {p,Ci,C2) can be represented as the union of sets 
•^S(P' Ci,C2) for <(3< /3f Define ^1,^2) by 

Ri < I{T AVi\V2U)^ aI{Z AVi\V2U) + Ci- /3J^"\ 

i?2 < I{T A V2\ViU) a)I{Z A V2\ViU) + C2 - (1 - P)4°'\ 

i?i +i?2 < I{T AViV2\U) - aI{Z AVi\V2U) - {1 - a)I{Z AV2\ViU) 



+ Ci + C2 — Jq \ 



Ri + R2< I{T A V1V2) - I{Z A V1V2). 



Lemma 5.2. We have for every a G [a^ , a-j^ ] 

This is seen immediately using Lemma 4.2. 
For Case 3: Define 

We have /3^^^ < /jj^^ because /(Z A V1V2) < Ci + C2. 

Lemma 5.3. For < /? < /3f^ let ^f\p,Ci,C2) be the set of those real 
pairs (i?i,i?2) satisfying 

Ri < I {T A Vi\V2Uo) + Ci - 131 {Z A V1V2), 
R2 < I{T A V2\ViUo) + C2 - (1 - P)I{Z A V1V2), 
Ri+R2< min{/(T A ^1^21^7) + C1 + C2- I{Z A V1V2), 
I{T AV1V2) - I{Z AVxVi)]. 

Then 

^«(p,Ci,C72)= y 4^)(p,Ci,C2). 

Thus it is sufficient to show the achievabihty of <^^^^(p, Ci, C2) for every jj. 
For the proof one uses Lemma 4.2. 

5.2 Coding 

Let Ci,C2 > and let p G TJci+Cs- Further let (-Ri,i?2) S ^(j?, C*!, C2). In 
Case 1 we then know that there is a /3 G [/3^^\/3l^^] such that (i?i,i?2) e 
<^?^(p,Ci,C2), in Case 2 we have an a G [af\af'^] and a /3 G [^^^'"\ /3f '"^] 
with (J?i,ii2) e ^i^^(p,C'i,C'2). For Case 3, there is a /3 G with 
{Ri,R2) G ^^^^(p,Ci,C2). Recall the notation 

{I{Z A U) in Case 1, 

aI{Z AV2U) + {l-a)I{Z AViU) in Case 2, 
I{Z AV1V2) in Case 3. 

We set 

R^'^ := Ri A (Ci - p4"^), := R2 A {C2 - (1 - ^) J,$"^) 



and 

R,:=R,-Rj^^ {u = l,2). 

Then setting 

Ro '■= Rq^^ + 

we conclude that 

{3gf\p) in Case 1, 
{Ro, i?2) e < ^i'^(p) in Case 2, 
\Mf \p) in Case 3. 

In particular, {Rq, Ri, R2) is achievable by the wiretap MAC W with common 
message under the common randomness bound Ci + C2. That means that for any 
77, £ > and for sufficiently large n, there is a common-message blocklength-n 
code which has the form 

G : [ko] X [Ki] X ^ ^(^" X ^"), 
: ^" ^ [Ko] X [i^i] X [^2], 

and the proof of Theorem 3.1 shows that we may assume that G is given by 

G{x,y\ko,ki,k2) = ^ Gi{x\ko,ki,lo)G2{y\ko,k2,lo) 
^0 lo=l 

for two stochastic matrices G\,G2- For Lq we have the bounds 



j(") + ^<ilogXo<j(<^) + f. 

Without loss of generality we may additionally assume that Lq^-* := Xq and 
£(2) := L^^"'^^ are integers. If < 277 < rma.{R^ : v = Q,l,2,R^ > 0}, the 
codelength triple [Ko, Ki,K2) may be assumed to satisfy 

[R^ - 2rj]+ <- log k^<[R,-r]]+, {u = 0,1,2), (72) 
n 

and both the average error as well as I(MoMiM2 A Z") arc upper-bounded by 
£, where (Mo,Mi,M2) is distributed uniformly on [Ko] x [Ki] x [^2] and is 
Eve's corresponding output random variable. The definitions imply that 

-logi4:o^<Ci+C2. 

n 

We can find k^^\k^^^ such that K^^ = K^^^K^^^ and < Kq and satisfying 

[^r-2r?]+<^logif('')<[i?r-|] + , (73) 
[^o-2?7]+<^log^^. (74) 



Thus one obtains a natural embedding 

[^.$'''] X [4^^] C [L2"^-J] (^ = 1,2). (75) 

We now construct a wiretap code with conferencing encoders. Let 
K,:=K^o"^K, (1^ = 1,2). 

Thus every k^, € [K^] has the form {av{kj,),hv{kv)) with a^{k^) G [-^o'^^] and 
Kikv) S [Ki,]. We then define a stochastic one-shot Willems conferencing pro- 
tocol 

ci : [K,] ^ ^([L2"^iJ]), C2 : [K2] ^ ^([[2"^^]]) 

which is used to generate both a common message as well as common ran- 
domness. Given a message ki, e [K^], Alice^ chooses an l^, uniformly at ran- 
dom from the set [Lg"^^] and then maps the pair {kv,lv) to {av{ki,),lv), so 

Next we define stochastic encoders Gi , G2 as in the definition of a code with 
conferencing encoders by setting 

/ := [[2"*^^]] X [[2"*^^]] 

and, using the embedding (75), 

Gi(x|/ci,j) = Gi(x|(ai(A;i),4'^),6i(/ei),(Zi,/2)) 

if j = ((ai(fci), li), (fcg ,^2)) and lotting Gi(x|A;i. j) be arbitrary else; G2 is de- 
fined analogously. For decoding, one takes the decoder from the common message 
code and lets it combine the messages it receives into elements of [Ki] and [K2]. 
By (72), the numbers Ki and K2 satisfy 

-\ogKi>Ri-3r], 
n 

-\ogK2>R2-3r]. 
n 

Thus depending on the case we are in, every rate pair (i?i,i?2) contained in 
^''^\p, Gi, C2) or ^S(p, Gi, G2) or ^f\p, Gi, G2) is achievable. 

6 Discussion 

6.1 Conferencing and Secret Transmission 

This subsection is devoted to the comparison of the wiretap MAC without confer- 
encing nor common randomness and the wiretap MAC if conferencing is allowed. 
As our focus is on conferencing, we assume that common randomness can only 
be established by conferencing. We show that there exists a wiretap MAC where 



the only rate pair contained in the region (10) achievable without conferencing 
is (0,0), whereas if conferencing is enabled with arbitrarily small Ci,C2 > 0, 
then the corresponding achievable region contains positive rates. Note that this 
does not mean that there are cases where conferencing is necessary to establish 
secret transmission as we do not have a converse. This restriction limits the use 
of this discussion and should be kept in mind. 

Our goal is to find multiple access channels W(, and Wg such that for every 
Markov chain ((V^, Fa), (X. F), (T. Z)) where Pt\xy = Wb and Pz\xy = 
and where Vi and V2 are independent one has 

7(T A V1V2) < I{Z A V1V2). (76) 

We noted in Remark 3.8 that (10) is the achievable region without conferencing 
and it is easy to see that condition (76) is an equivalent condition for this region 
to equal {(0,0)}. Thus the only rate pair which is achievable according to our 
above considerations is (i?i,i?2) = (0,0). At the same time, there should be a 
Markov chain [U, {X, Y), (T, Z)) for the same pair of channels Wb and We such 
that 

I{T A XY) > I{Z A XY). 

This would prove the existence of a rate pair (iii, i?2) with positive components 
for arbitrary Ci, C2 > 0. 

We recall one concept of comparison for single-sender discrete memoryless 
channels (DMCs) introduced by Korner and Marton [22]. 

Definition 6.1. A DMC W,, : ^ -> ^{^) is less noisy than a DMC Wb : 
-)> .^{^) if for every Markov chain {U,X,{T,Z)) with Pt\x = Wb and 
Pz\x = We one has 

I{Z AU)> I{T A U). 
It was observed by van Dijk [35] that this is nothing but saying that the function 

Px^I{ZAX)-I{TAX), Px€^{^) 

is concave. Now we generalize this to the MAC case to obtain an equivalent 
condition for (76). 

Lemma 6.2. (76) holds for every Markov chain ((Vi, V2), (X, F), (T, Z)) with 

independent Vi , V2 and X independent of V2 and Y independent of Vi and 
Pt\xy = Wb and Pz\xy = We if and only if the function 

{Px, Py) ^ I{Z A XY) - I{T A XY), X, Y independent r.v.s on ^ x ^ 

is concave in each of its components. 

Proof. Let a Markov chain be given as required in the lemma. One has 



I{ZAViV2)-I{TAViV2) (77) 
= {I{Z A XY) - I{T A XY)) - {I{Z A XY\ViV2) - I{T A XY\ViV2)) . 



Now note that the rightmost bracket equals 



Vl V2 

{I{Z A XY\Vi =vi,V2 = V2) - I{T A XY\Vi =vi,V2 = %)) , 

so it is clear that the nonncgativity of (77) is equivalent to the concavity in each 
component of the function from the lemma statement. □ 

We now define the channels Wb and We which will provide the desired exam- 
ple. Let Ni,N2 be i.i.d. random variables uniformly distributed on {0, 1}. The 
input alphabets are X = "3^ = {0, !}• The output alphabet of Wh is GF(?>) and 
the output alphabet of We is {—2,. ..,3}. The outputs t of VFb are given by 

those of We by 

z = 2x-2y^ N2. 

The intuition is that in We, one can exactly determine through the output 
whether or not the inputs were equal and if they were unequal, which input 
was and which was 1. For Wf,, however, there are for every output at least two 
input possibilities, so it is reasonable that an independent choice of the inputs 
makes We better than W^. However, if one may choose the inputs with some 
correlation, one may choose the inputs to be equal. Then the output of We is 
only noise, whereas one can still extract some information about the input from 
W5. 

As the entries of the corresponding stochastic matrices of both channels are 
only 1/2 or 0, the conditional output entropy is independent of the input distri- 
bution and equals 1. Further any pair of independent random variables on ^ 
and ^ is given by parameters g, r G [0, 1] such that 

P[X(«) = 0] = 9, p[y('') = 0] = r. 

Thus in order to determine whether (76) holds, it is enough to consider the 
function if (Z^?'^)) - F(T(9''")) for T^"'''), being the outputs of Wb and We, 
respectively, corresponding to the pair (X('), F^"")). One has 

/z(g, r) := iJ(Z(«''^)) = -q{l - r) log(g(l - r)/2) 

-{qr + (1 - q){l - r)) log((gr + (1 - q){l - r))/2) 
-(l-g)rlog((l-g)r/2) 



and 



fT{q,r) := F(r(«''^)) 

= ~{qr + (1 - q){l - r)) log((gr + (1 - q){l - r))/2) 

-\{qr + g(l - r) + (1 - q)r) \og{{qr + q{l - r) + (1 - q)r)/2) 

-\{q{l-r) + {l-q)r + {l-q){l-r)y 

■ log((5(l - r) + (1 - g)r + (1 - q){l - r))/2). 

Both entropies are symmetric in q and r and continuous on [0, 1]^ and differen- 
tiablc on (0, 1)^, so by Lemma 6.2 it suffices to find the second derivatives in q 
of both of them and to compare. 
We have 

^(g,r)=-(l-r)log(g(l-r)/2) 

- (2r - 1) log((gr + (1 - - r))/2) 
+ rlog((l-g)r/2) 



and 



Thus 



^(g, r) = -\{2r- 1) log((gr + {l-q){l- r))/2) 

- r) log((gr + g(l - r) + (1 - g)r)/2) 
+ ^ log((9(l - r) + (1 - g)r + (1 - q){l - r))/2). 



d^fz, , 1-r (2r-l)2 
-(9,r-) = -- 



and 



dq^ ' g gr + (1 — — r) 1 



' 2{qr + {1 - q){l - r)) 

(l-r)2 



2(gr + g(l-r) + (l-g)r) 



"2(g(l-r) + (l-g)r+(l-g)(l-r))- 



After some algebra, it turns out that for q,r G (0, 1), 



5,2 feO-^(9,r) = - 



re (0,1), 




1 - r q^ 


-2r — qr 


2q q- 


]- r — qr 


(2r 


-If 


2{qr + (1 


-q){l-r)) 


r 


2 — r — qr 


2(1 -g) 


1 — qr 



< 0. 

Thus fz — /t is concave and (76) is true for W^, We- 

Now we show that there exists an input distribution with I{T A XY) > 
I{Z A XY). Of course, X and Y cannot be independent any more in this case. 
Every probability distribution p on {0, 1} induces a probability distribution 
on {0, 1}^ via p^(x,x) — p{x). Let the pair {X,Y) be distributed according to 
p. It is immediate from the definition of We that I{Z A XY) = 0. On the other 
hand, Pt can be described by the vector (l/2)(l,p(0),p(l)). Thus one sees easily 
that this is maximized for p{0) = p{l) = 1/2, resulting in 

I{TAXY) = ^. 

p^ is identified as an element of 11 by setting = {0,1}, Pu = Px, and 
Px\u = Py\u = ^u- Note that I{Z A f/) = 0, so secret transmission is possible 
with arbitrarily small conferencing capacities Ci,C2 > 0. 



6.2 Necessity of Time-ShEiring in Random Coding 

We show here that doing time-sharing during random coding is necessary for 

our method to work. This only serves to justify the effort wc had to make in 
coding. We concentrate on Case and 1. Then we have to show that it may 
happen that a^^' > or a^^^ < 1. Let ^ = ^ = =3^ = ^ = {0, 1} and let 
Wb, We : {0, 1}2 ^({0, 1}) be defined by 

0.9271\ 

0.2736 
0.6338 ' 
0.5357/ 

where the output distribution for the input pair [x, y) is given in row number 
2x + y for each matrix. With q = 0.6933 and r = 0.3151, let p = p^i^ 'Sip^''^ e 
X ^) be the product measure with the marginals 



/0.6178 0.3822^ 

0.0624 0.9376 

0.9350 0.0650 

V0.2353 0.7647/ 



We 



/0.0729 

0.7264 
0.3662 
\o.4643 



p(«) = (g,l-g), pW = (r,l-r). 



Note that p € Uq. One obtains the following entropies: 



H{T\XY) w 0.5685, H{Z\XY) w 0.7851, 

H(T\X) w 0.8532, H{Z\X) w 0.9952, 

H{T\Y) « 0.6251, H{Z\Y) w 0.8442, 

H{T) f« 0.8866, H{Z) w 0.9999. 

Calculating with the above values returns 

7(T A Xy) =0.3181, I{Z A XY) = 0.2147, 

I{T A X\Y) = 0.0566, I{Z A X\Y) = 0.0590, 

I{T A Y\X) = 0.2847, I{Z A Y\X) = 0.2101, 

I{Z AX) = 0.0047, 
I{Z AY) = 0.1557. 

Thus the conditions (3) and (4) arc satisfied. If He < mm{I{Z A X\Y),I{Z A 
Y\X)} = 0.0590, then we can only show that or ^(^^(p) is achievable 

and might have to use time-sharing during random coding to do so. In fact, this 
is necessary as 

I{Z AX\Y) > I{TAX\Y), 

whereas 

I{ZAY\X) < I{TAY\X). 

Hence Uq'^ > 0, but a^^^ = 1. This example was found by a brute-force search 
using the computer. 



A Proof of Lemma 4.2 

The direction "c" in (12) is obvious. For the other direction, let {Rq, Ri, R2) € 

Jf. We may assume that for some < < 1, 

Ri=ri- f3{aiai + (1 - ai)bi) - (1 - /3)(aoai + (1 - aa)bi) 
= ri - {I3ai + (1 - /3)ao)ai - (/^(l - ai) + (1 - /3){1 - ao))h 

because the claim is obvious for .Ri < ri — aiUi — (1 — ai)6i. We show that 
{Ro,Ri,R2) £ J(pai+{i-fS)ao- The i?i-bound is satisfied due to our assumption. 
Further due to the bound on i?i + R2, 

R2 

<n2-c-n + {pa, + (1 - 0)Q.o)ai + (/3(1 - a,) + (1 - 0){1 - ao))bi 
<r2- (/3qi + (1 - P)ao)a2 - - ai) + (1 - /3)(1 - ao))b2, 

so i?2 also satisfies the necessary upper bound. The sum constraints arc indepen- 
dent of a. Hence all upper bounds in the definition of J^iSa:i+{i-/3)ao satisfied, 
and Lemma 4.2 is proved. 



B Proof of Lemma 4.5 



For a S [aojQ'i]- the set Jta is contained in the convex huU oi Jtag UJta-^. Thus 
we only have to prove that J{f = conv{J(^ao U Ji^ai)- Without loss of generality 
we assume that b > a. 

We first prove conv{.J^aa U J^^J C -J^ . Let (_Ro, -Ri, -R2) G fOT?,''(,/^,.„ U-J^^J. 
Using the convexity of J(faa ^nd J^^^ we infer that there is a {Rq''\ Rf^\ R^2^) £ 
and a {r\^\ R^i\ r'"2^ ) e Jf^ai and a /3 e [0, 1] such that 

{Ro,Ri,R2) = /3(i?o°\-Ri°^-R2°'') + (1 ~" P){Ro^^ ^2^^)- 

One sees immediately that {Rq, Ri, R2) satisfies the bounds (17)-(19) and (21). 
It is sufficient to check that (20) is satisfied by the triples {Rq'\ R^\ R'^^ ) and 
{R^o \R[^\R'i^). For (i?*°\ i?^"' ) we assume that 



= 7(^1 - ceoa) 
for some 7 € [0, 1]. After some calculations this yields 

bR^^ + aR^^ < {b — a)ri + ar\2 — a& — (1 — 7) (6 — a)(r\ — a^a) 
<{b — a)r\ + ar\2 — ab. 

One proceeds analogously for {R^\ r'^\ R2'^ ) . 

Next we have to check that J(f C conv{J(fao U -^i)- It is sufficient to check 
whether those points {Rq, Ri, R2) are contained in conv{Jta(, UJt^ai) that satisfy 
both (20) and one of (17)-(19) with equality. So assume that 

bRi + aR2 = ri2a + ri{b - a) - ab. (78) 

First we also assume that 

Ri+ R2 = ri2 — aoa - (1 - ai)b. 

Then 

R2 = ri2 - aoa - (1 - ai)b - Ri 
and using (78) we obtain 

aib — aoa 

Ri = ri ; a < ri — aia. 

— a 

For R2 this gives 

„ / aib — aoa\ 

R2 =ri2-n- ( Qo H — 1 a - (1 - ai)b < r2 - (1 - ai)o, 

so (J?i, J?2) S jXfai- 



Now we assume 



i?i = ri — aoa. 



Then inserting this in (78) one obtains 



-R2 < r2 - (1 



ao)b, 



so i?2) G Jta 

Finally for 



i?2 = r2 - (1 



ai)b 



we obtain 



i?i < ri — aia. 



so {Ri,R2) e .^i- This proves the lemma. 
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